@staix/agent-hub 0.20.0 → 0.22.0

package/docs/smoke.md

@@ -39,6 +39,8 @@
 | Antigravity TUI close (#485) | Antigravity P1 | agent-executable | |
 | Managed Pi live receipts (#418 AC8) | none yet (issue #418) | person-only, then agent-executable | the person opts in to a check runner and answers the approvals |
 | Kimi credential probe (#285 AC9) | Kimi usage counting | person-only | the owner's approval of the probe |
+| Six role instances (#525-6, hub card #138 I4) | Six role instances (#525-6) | person-only | native terminal/account starts, the person's sandbox and approval choices, and the live six-instance verdict |
+| Model/effort provider execution (#266 AC1) | Model and effort capability verification (#266 AC1) | external-blocked | isolated configured Kimi session and provider/account fixtures; no login or account/provider edits authorized by this receipt |
 
 ## Issue #273 operator execution plan (2026-10-16)
 
@@ -1761,6 +1763,8 @@ Qwen recovery source/fake proof: saved ids pass through the driver and CLI to AC
 
 Source/fixture proof is recorded in verification/2026-10-11-jcode-peer-contract.md; the live owned-daemon and ACP handshake on 0.94.0 and 0.98.1 in verification/2026-10-19-jcode-0.98.1.md. Unverified: real provider/model, native project MCP discovery and hub-tool receipt, native tool policy and stop/child teardown. Native automatic restoration is withheld because the pinned ACP load does not prove the id. No benchmark comparison or default replacement ran.
 
+Historical native-owned hub-tool effects are now recorded in the [ids-only AC4 receipt](verification/2026-10-30-jcode-ac4.md). The [fresh isolated 0.99.1 AC6 re-probe](verification/2026-10-30-jcode-ac6.md) still finds no `session/load` identity echo, so automatic recovery remains withheld; no fresh model turn or persisted-conversation restoration is claimed.
+
 ### Extra Jcode instances (#685, #368)
 
 Source and fixture coverage: `test/jcode-instances.test.ts` (declaration refusals, the bound of 8, home uniqueness, no relay or credential fields), `test/jcode-instance-peer.test.ts` (separate groups, sockets and homes, stopping one leaves the other, argv is the base argv plus the instance's `-p`, `--model` and `--provider-profile`, launch id per owned process, launcher, doctor) and `test/jcode-instance-daemon.test.ts` (home preflight, no file written under the home, status, hub-tools admission only for an owned launch, a forged `AGENTHUB_PEER_ID` refused, the MCP server with no peer id refusing every tool).
@@ -2028,3 +2032,132 @@ Kimi usage ceiling: 2.2.0 print stream-json exposes no token counts. Keep unobse
 ## Held deliveries and peer retries (#434 AC8, 2026-10-24)
 
 See [delivery holds and peer retry verification](verification/2026-10-24-delivery-holds-ac8.md) for live evidence of hub-settled held deliveries (39 superseded notices in `resolution_history`) and peer retries (2 peer retry rows in `resolution_history`, 27 rows across Claude, Jcode, and Kimi in `delivery_retry_evidence`), alongside daemon status and queue readbacks.
+
+
+## Six role instances (#525-6)
+
+**Status: unverified. Class: person-only.** This is the I4 live leg retained by hub card #138 and [the accepted #525 role-stage contract](specs/2026-09-19-agent-hub-design.md#amendment-roles-per-sdlc-stage-525). No native/account result is recorded by adding this procedure. Fake protocol and daemon acceptance tests do not satisfy this live leg. The six instances below are declared role instances; the person's builtin coordinating session is not a seventh test instance.
+
+- Use a disposable committed Git repository and a candidate daemon, CLI and Claude plugin built from the same recorded head. Record native versions, account/model identities without credentials, OS, candidate head and project id. Follow the normal setup/authentication steps first; the hub never signs in for the person.
+- Create registered attached-branch worktrees for the two writing instances before declaring them:
+
+```sh
+git worktree add -b smoke-claude-impl .worktrees/claude-impl
+git worktree add -b smoke-codex-impl .worktrees/codex-impl
+```
+
+- Add the following to that disposable project's untracked `.agenthub/config.local.json`, preserving unrelated required setup values, and restart the hub. Restrict this trial's owner routing and reviewer pool to the listed role instances so an unrelated builtin does not satisfy a step.
+
+```json
+{
+  "instances": {
+    "claude-plan": { "kind": "claude", "roles": ["planner"] },
+    "claude-impl": { "kind": "claude", "roles": ["implementer"], "start_mode": "headless", "worktree": ".worktrees/claude-impl", "permission_mode": "ask" },
+    "claude-review": { "kind": "claude", "roles": ["reviewer"], "start_mode": "headless" },
+    "codex-plan": { "kind": "codex", "roles": ["planner"], "start_mode": "headless" },
+    "codex-impl": { "kind": "codex", "roles": ["implementer"], "start_mode": "headless", "worktree": ".worktrees/codex-impl" },
+    "codex-review": { "kind": "codex", "roles": ["reviewer"], "start_mode": "headless", "review_mode": "fresh" }
+  },
+  "planner": ["claude-plan", "codex-plan"],
+  "review": { "pool": ["claude", "codex"], "same_family": "never" },
+  "roster": { "claude-plan": true, "claude-impl": true, "claude-review": true, "codex-plan": true, "codex-impl": true, "codex-review": true }
+}
+```
+
+- The person starts each instance with its native command and `--as <id>`: `ahub claude --as claude-plan`, `ahub claude --as claude-impl`, `ahub claude --as claude-review`, `ahub codex --as codex-plan`, `ahub codex --as codex-impl`, and `ahub codex --as codex-review`. Use separate native terminals for the channel/TUI sessions. Headless Claude implementer and fresh reviewer starts may be idle without a child until their task or review arrives; that is not a failed start. Do not reuse a builtin's launch id, peer id, transcript or recorded native session as proof for an extra.
+- On `codex-plan`, start and resume a native thread through its proxy. Record the read-only request and positive confirmation from the native response, with session/launch identifiers screened. If confirmation is missing, malformed or writable, record the refusal and stop. No adoption or hub delivery may follow that refusal; the positive native start/resume check remains failed or unverified. Do not relabel unknown as read-only. The person's attached TUI can later choose a different native sandbox; record such a choice separately and do not claim an unchangeable hub sandbox.
+- On `claude-plan`, request a bounded scratch-file mutation and shell operation from its native session, inspect that the facts hook emitted no automatic grant, and let the person choose the native outcome. A native permission setting or explicit native allow is not a hub grant. Confirm neither planner can be assigned a code-write owner role merely because it is a planner. A normal planning write through `Tasks` should still work for the task's effective planner.
+- Run two non-PII throwaway tasks through real native holders. For task A use `codex-plan` to plan, `claude-impl` to build in its own worktree, and fresh `codex-review` to review. For task B use `claude-plan`, `codex-impl` and `claude-review`. Use the person's documented `ahub task assign <id> <peer> --role planner|owner|reviewer` controls when naming holders; never alter the board directly. Keep each implementer out of its own review, apply the existing family rule, and have the other eligible planner review an authored plan rather than treating a planner's own verdict as independent. Capture the actual assignment/acceptance/done/verdict history and reasons, not just the intended roster.
+- Compare `ahub status`, `ahub task show <id>` (and `--json`), `ahub route explain <id>`, console Tasks/peer detail and dashboard task detail. Check distinct six ids, the correct form and capable/effective roles, planner/owner/reviewer plus their recorded reasons, and `ownerIsolation` for each writing extra. The planner-only canonical-checkout instances should report not isolated with a fixed reason, rather than be mistaken for isolated code writers. Missing evidence is unknown or not isolated, never success.
+- Exercise a second turn of a Claude implementer's task and a separate new task, recording that the former resumes its own per-task session and the latter does not inherit it. Keep queues, MCP actors and native sessions distinct while the other role instances remain attached. Stop the disposable trial's runtimes and verify owned-group cleanup without stopping unrelated project peers.
+- Record a dated receipt here or in `docs/verification/` with the candidate/native versions, six actual instance ids and forms, task ids/holder histories, isolation evidence, read-only confirmations/refusals, planner hook evidence, session/queue separation, cleanup result and any failures or unknowns. Do not copy credentials or private task bodies. Until that receipt exists, this leg remains **unverified** and supplies no native-account or sandbox attestation.
+
+## Disposable Qwen Q2 runner (#787, task #462)
+
+`ahub --live-test smoke run qwen-dual-output` runs only the Q2 dual-file protocol leg: submit a fixed synthetic first prompt, submit a second while the first streamed turn is observed running, and require the second user event after the first assistant/message_stop pair. Two assistant/message_stop pairs must complete in order. It never answers a tool approval or sends TUI keys.
+
+The first slice requires a freshly initialized, uncommitted Git project with no tracked index entries, refs or remotes. Its canonical root must be an immediate `ahub-smoke-*` child of the system temporary directory. It needs its own registered project id, an explicitly set `AGENTHUB_HOME` inside that root, and an existing state directory inside the same root. Linked worktrees, symlinked paths, the default real hub home and ordinary projects are refused. These are disposable-target safety checks, not a sandbox for a malicious executable.
+
+From a person terminal, prepare the fixture without borrowing an existing project's HOME or state:
+
+```sh
+scratch=$(mktemp -d "${TMPDIR:-/tmp}/ahub-smoke-XXXXXX")
+scratch=$(cd "$scratch" && pwd -P)
+git -c init.templateDir= init -q "$scratch"
+export AGENTHUB_HOME="$scratch/hub-home"
+mkdir -p "$AGENTHUB_HOME" "$scratch/.agenthub/state"
+ahub --project "$scratch" init
+ahub --project "$scratch" projects --json
+```
+
+Take the fixture's `p_...` id from that last result. Configure `OPENAI_API_KEY`, `OPENAI_BASE_URL` and `OPENAI_MODEL` through the normal account setup; do not paste credentials into the command or a receipt. The runner uses the configured HTTP or HTTPS OpenAI-compatible endpoint. Then run:
+
+```sh
+ahub --project "$scratch" --live-test smoke run qwen-dual-output --project-id <fixture-id> --receipt receipt.json --timeout-ms 60000 --json
+```
+
+The runner creates a private native HOME and a separate empty Git project beneath the fixture. Qwen gets only the required environment, no caller agent markers, hooks or MCP servers. Its native version must pass the existing `qwen-dual` policy. Linux uses util-linux `script`; macOS uses a Bun PTY bridge because BSD `script` requires a terminal on its parent's stdin. The bridge remains an owned child and its native descendants use the same process-group cleanup. PTY output is drained with a 1 MiB cap and is never logged or saved in the receipt. Events have an 8 MiB cap and individual JSON lines a 64 KiB cap. Deadline, abort, early exit, an approval request, malformed data or failed cleanup cannot produce a passing receipt. Only processes owned by this invocation are stopped. Native files are removed after confirmed cleanup; unconfirmed cleanup leaves its private `.smoke-run-*` directory for inspection.
+
+The new receipt must be a previously absent file directly under the fixture root. It contains fixed schema/leg/outcome/reason names, boolean checks, counts and timings only. It contains no prompt, native session id, credential, endpoint, model name, native output or filesystem path. `--json` prints that same document; the default output is a short outcome/count summary. Each invocation uses the existing ids-only CLI audit, including delegated `--live-test` invocations. Never delete a fixture whose cleanup is unconfirmed.
+
+Real-account Q2 receipt: **UNVERIFIED**. The conductor runs this leg with the person after merge. Fake PTY/protocol tests are implementation evidence only. Q3 approvals, Q5 FIFO and Q6 resume are later executable legs. Q4 remains the known native Qwen turn-stop limitation documented in the 2026-10-25 T0 receipt; the runner's owned-group timeout cleanup does not claim a supported in-session turn interruption.
+
+## Capability source probes (#445 C0)
+
+The 2026-10-30 [receipt](verification/2026-10-30-445-capability-probes.md) records what Kimi 2.3.2, Qwen 0.26.1 and Codex 0.166.0 expose for capability discovery, probed in isolated, credential-free homes with a network-denied profile and real config files checked unchanged. Listing legs are live; skill execution on each agent needs an account and stays **UNVERIFIED** until #445 C4. Design consequences: [Capability invocation (#445)](specs/2026-09-19-agent-hub-design.md#capability-invocation-445).
+
+## Model and effort capability verification (#266 AC1)
+
+The 2026-10-29 [version-bound capability table](specs/2026-09-19-agent-hub-design.md#vendor-model-and-effort-controls-266-ac1)
+and [sanitized native receipt](verification/2026-10-29-model-effort-capabilities.md)
+record agent-executed, model-free configuration/control observations: Codex
+0.165.0, Claude Code 2.1.312 and Kimi 2.3.2. Every invocation used fresh isolated
+`HOME`, `CLAUDE_CONFIG_DIR`, `CODEX_HOME`, `KIMI_CODE_HOME` and XDG directories,
+a scratch cwd, an environment without real credentials and a network-denied
+Seatbelt profile. Calls were sequential and bounded. No login, update, account
+or saved provider configuration command was run. Native input/output text,
+session ids and usage data are absent from the receipt.
+
+Observed outcomes:
+
+- Codex launch model/effort config and thread overrides read back as requested.
+  A per-turn replacement survived interrupt and no-override resume; permission
+  and sandbox readbacks were unchanged. The turn did not complete, and no
+  provider-serving claim follows from the frontend state.
+- Claude accepted launch model/effort flags, acknowledged an in-session model
+  change and returned the selected model family. Launch effort status and an
+  in-session effort change both read back as requested in print mode. The
+  inputs were local slash commands, with no inference prompt sent to a provider.
+- Kimi initialize passed; session creation returned `-32000`. Runtime model and
+  graded-effort controls remain **UNVERIFIED** in this fixture. A missing or
+  rejected session is not evidence that the methods are unsupported.
+
+To repeat the model-free leg, create a fresh private scratch cwd and distinct
+HOME/config roots for each process. Clear credential, gateway, agent and provider
+overrides from the child environment; disable ancillary traffic and deny network
+access. Do not copy a real account or provider config. Record only versions,
+request counts and fixed outcomes, and terminate/reap the owned process on a
+short deadline.
+
+1. Read native `--version`/`--help`. For Codex, generate the installed protocol
+   schema with `app-server generate-json-schema --experimental --out <scratch>`.
+2. Codex: initialize, inspect model/config metadata, create a read-only thread,
+   then compare turn overrides with no-override resume readback. Keep any
+   disposable input in memory and out of the receipt; interrupt the one bounded
+   attempt before cleanup. Compare permission/sandbox metadata too.
+3. Claude: initialize a tool-free, no-session-persistence print/control process.
+   Compare launch effort with `/effort status`, set a different session effort
+   and query status again. Use `set_model` for the model control check; do not
+   infer provider selection from an alias echo alone.
+4. Kimi: initialize and create an empty-MCP session. If it refuses, stop and mark
+   the setting cells unverified. Otherwise inspect the advertised config options
+   before sending a setter. `session/set_mode` is permission policy, not effort.
+
+Remaining **UNVERIFIED** legs: Kimi model selection/effort readback in an authorized
+isolated configured session; actual provider model/effort application for all
+three vendors; a real interactive Claude session; and a two-arm effort matrix.
+A later model-free fake-endpoint fixture needs its scope approved first; a real
+account fixture needs the person's account setup. Ask the planner before any
+quota-heavy run. Never publish prompts, tokens, credentials, endpoints, native
+transcripts or session ids as evidence. This slice implements no task `exec`,
+routing policy or matrix runner.