@staix/agent-hub 0.22.0 → 0.23.1

package/docs/specs/2026-09-19-agent-hub-design.md

@@ -1170,7 +1170,18 @@ local hub work available. Fake-hub/broker tests are not a live TLS/proxy or X7 r
 
 This implements frozen D3/D5 from issue #446, comment 6242775004, with the
 approved X4 refinements and R1 clarifications. X5 metadata views are described
-below; X6 invocations and X7 live two-machine receipts remain separate.
+below; X7 live two-machine receipts remain separate.
+
+### X6 as built (#446, task 187)
+
+- Cross-hub invocations are read-only and require consent by pinning on both hubs. The source person pins the exact `peer@label`, capability id, digest and class `read` in the existing machine-local `invocation.share`; the target independently requires its current local share pin, effective read class, native schema and every #445 D4 gate. There is no inheritance between peers, instances or labels.
+- Discovery stays manual: the target person's existing `ahub capabilities` provides the digest out of band. X6 adds no remote discovery RPC or implicit sharing from room exposure alone.
+- Both sides validate arguments: bounded flat scalar shape at source, actual capability schema at target. Task, approval and other local refs never cross. Write, external and destructive invocations and approval/permission messages remain excluded.
+- Requests and results use closed, bounded encrypted application envelopes and opaque host provenance at the single room boundary. Generic hub/digest or raw agent invocation envelopes remain refused. A private or uncleared request is refused, never converted into an executable stub; an uncleared result is withheld without its body.
+- Target admission is bound to the signed room/member and current local capability. Durable invocation identity and result correlation include room, member fingerprint, peer ids, request id and digest. Dedupe never dispatches the same invocation twice; a mismatched or forged result cannot settle another call.
+- Local and remote nested calls retain the invocation turn identity and refuse depth 2 before another dispatch. Uncertain handoff, lost acknowledgement/result or restored uncertainty stays `needs_review`, never a silent retry. Signed application admission is distinct from a capability result.
+- Automated proof uses two fake hubs with the real built-in broker and crypto. Native account execution and live two-Mac X7 receipts remain separate and unverified.
+
 
 ### Egress and authority
 
@@ -6308,7 +6319,9 @@ wire/storage/protocol contracts remain constants.
 
 ## Capability invocation (#445)
 
-Plan of record: the #445 C0 freeze (issue comment of 2026-10-17, owner decisions O1-O5 of 2026-10-18, go-ahead 2026-10-25). Phases C1-C4 implement it in order and amend this section when they differ. Nothing below is implemented yet; the [C0 receipt](../verification/2026-10-30-445-capability-probes.md) records what the native sources actually expose.
+X6 remote reads require an exact source `peer@label` capability/digest/`read` pin plus the target's independent current local read pin and schema/D4 admission. The target person's `ahub capabilities` supplies the digest out of band; discovery remains manual, with no remote listing RPC. Room exposure alone grants no invocation, and no task or approval refs cross. See "X6 as built" under #446.
+
+Plan of record: the #445 C0 freeze (issue comment of 2026-10-17, owner decisions O1-O5 of 2026-10-18, go-ahead 2026-10-25). Phases C1-C4 implement it in order and amend this section when they differ. C1 (discovery) and C2 (read invocations) are implemented, see "C1 as built" and "C2 as built" below; C3 adds the write/external approval and audit path below; live receipts (C4) remain unverified. The [C0 receipt](../verification/2026-10-30-445-capability-probes.md) records what the native sources actually expose.
 
 Delegated execution, never shared execution: a peer publishes capabilities, another peer asks for one, and the target runs it in its own turn with its own permissions and sandbox. The hub never calls a native tool itself (Codex `mcpServer/tool/call` and `command/exec` are excluded) and never hands out credentials or MCP connections.
 
@@ -6316,9 +6329,9 @@ Delegated execution, never shared execution: a peer publishes capabilities, anot
 
 - **D1 manifest.** An adapter-definition field (`registry-types.ts`), one discovery path per adapter. Each `Capability` has `id` (`${kind}:${name}`, unique per peer id), `kind` (`command|skill|mcp_tool`), `name` (`/^[A-Za-z0-9_.:-]{1,64}$/`), a `sanitize()`d description of at most 300 characters, an optional flat `inputSchema` (absent means `{ input: string }`), the publisher's optional `sideEffect` (`read|write|external|destructive`), `source` (`acp|codex-skills|published`), `invoke` (`native|prompt`) and a `digest` over the canonical fields. Sources: ACP `available_commands_update` (`invoke: native`, the prompt `/name input`); Codex `skills/list` (`invoke: native`, the `turn/start` item `{ type: "skill", name, path }`); `hub_capabilities_publish` for Claude and others and Codex MCP tools (`invoke: prompt`). No cost hint.
 - **D2 opt-in and discovery.** `invocation.share` in `.agenthub/config.local.json` only (`invocation` is machine-local and never editable from settings): a positive allowlist keyed by peer id, each entry pinned by digest with the person's `class`. A changed digest unlists the entry until re-pinned; an instance id never inherits its kind's entries. `hub_capabilities { peer? }` lists shared entries only (id, schema, effective class, the target's permission mode); unshared ones appear only in the person's `ahub capabilities`.
-- **D3 authority.** Callers hold the new `invoke` hub capability; the conductor gets nothing extra. Effective class is the higher of the declaration and the person's `class` (O1); a side that names no class contributes nothing, and only when neither names one is the class `destructive` (O6). Gates: `read` needs no task and no approval; `write` and `external` need an open task whose owner or reviewer is the caller plus person approval on every call through `requestPermission` with a `personOnly` flag that bypasses unattended auto-allow (O2); `destructive` is refused (O3). Every hub-side refusal is a `PreEffectToolRefusal` with a precise reason before any envelope. A callee refuses with `[REFUSED] <reason>` (outcome `refused`); a native rejection is `failed`. Each invocation is a row in an `invocations` table in `hub.db` (ids, digest, class, task, approval id, args sha256, outcome, times, result bytes) plus an ids-only event; a task-scoped one adds history through `Tasks.recordInvocation`. Bodies are never logged.
+- **D3 authority.** Callers hold the new `invoke` hub capability; the conductor gets nothing extra. Effective class is the higher of the declaration and the person's `class` (O1); a side that names no class contributes nothing, and only when neither names one is the class `destructive` (O6). Gates: `read` needs no task and no approval; `write` and `external` need an open task whose owner or reviewer is the caller plus person approval on every call through `requestPermission` with a `personOnly` flag that refuses unattended mode (O2). The person-only prompt shows caller, target, capability, effective class, task id and argument digest, plus already PII-screened arguments sanitized and capped at 200 characters per value with a cut marker. Argument previews stay on person approval surfaces only, never logs, events, history or peer-visible views; `destructive` is refused (O3). Every hub-side refusal is a `PreEffectToolRefusal` with a precise reason before any envelope. A callee refuses with `[REFUSED] <reason>` (outcome `refused`); a native rejection is `failed`. Each invocation is a row in an `invocations` table in `hub.db` (ids, digest, class, task, approval id, args sha256, outcome, times, result bytes) plus an ids-only event; a task-scoped one adds history through `Tasks.recordInvocation`. Bodies are never logged.
 - **D4 PII.** `hub_invoke` is refused during a PII turn, for a PII task, and when the Tasks PII screen finds or cannot rule out PII in free-text args. The result is bounded to 8 KiB, `sanitize()`d, given a hub-written untrusted header, addressed to the caller only and never captured to memory.
-- **D5 transport.** New envelope kinds `invocation` and `invocation_result`, journalled, delivered alone and never condensed, priority `status`. `hub_invoke` returns `{ invocation, state: "queued" }` at once. Deadline `invocation.timeout_s` (default 600): still queued means `expired`; delivered without a result means `timeout` for `read` and `needs_review` otherwise. No caller cancel; the person uses `ahub queue resolve`. Offline, paused, held, off-roster and pull-only targets are refused (O4). Depth 1: no `hub_invoke` inside an invocation turn. `invocation` joins `DAEMON_FEATURES`; upgrade and restart refuse while invocation rows are open on a target without it.
+- **D5 transport.** New envelope kinds `invocation` and `invocation_result`, journalled, delivered alone and never condensed, priority `status`. `hub_invoke` returns `{ invocation, state: "queued" }` after admission and any required person approval. Deadline `invocation.timeout_s` (default 600): still queued means `expired`; delivered without a result means `timeout` for `read` and `needs_review` otherwise. No caller cancel; the person uses `ahub queue resolve`. Offline, paused, held, off-roster and pull-only targets are refused (O4). Depth 1: no `hub_invoke` inside an invocation turn. `invocation` joins `DAEMON_FEATURES`; upgrade and restart refuse while invocation rows are open on a target without it.
 - **D6 failures.** An uncertain `write` or `external` outcome is `needs_review` and never retried; a `read` may be redelivered once, on a `failed_safe` receipt only.
 - **O5.** `invoke: prompt` capabilities are listed and invocable, labelled as model-mediated requests.
 - **O6 (2026-10-30).** `destructive` applies only when neither the publisher nor the person's share entry names a class. It relaxes the freeze's "undeclared reads as `destructive`", which with O1 would have refused every native capability, since no native listing declares a class.
@@ -6335,3 +6348,52 @@ Probed on Kimi 2.3.2, Qwen 0.26.1 and Codex 0.166.0 in isolated, credential-free
 - **Native rejection.** Qwen rejects a command outside its ACP set with `-32603`; Kimi ends the turn normally with an "Unknown ACP command" text chunk (source reading). C2 maps Qwen's error code and matches Kimi's text to `failed`.
 - **Codex.** `skills/list` answers with no thread and no auth. The `skill` input item is in the stable schema; a live skill turn is unverified. `mcpServer/tool/call` has no approval gate in the 0.166.0 source, which confirms its exclusion.
 - **Unverified until C4.** Executing a skill through `/name input` on Kimi or Qwen and a Codex `skill` turn (each needs an account), and listings under a real login.
+
+### C1 as built (#445, task 178)
+
+C1 lists capabilities and nothing else: no `hub_invoke`, no `invoke` capability, no envelope kinds, no `invocations` table. These points are where the build fixes or differs from the freeze above.
+
+- **Where.** `src/hub/capabilities.ts` holds the pure rules (digest, sanitizer, flat schema, publish validation, share listing). The two native parsers and their version pins are vendor-specific, so they live in `src/adapters/native-capabilities.ts`, where the #451 registry guard allows vendor literals. `AcpPeer` and `CodexPeer` implement a new optional `PeerAdapter.capabilityManifest()`; the daemon reads it per call, never a cached or probed copy. The per-definition `capabilities.manifest` field of D1 is not used: the port on the adapter is.
+- **No class is declared natively.** `Capability.sideEffect` is optional and absent for every native listing, so the digest carries `null` for it. `effectiveClass` is the higher of the declared and the person's class, a side that names none contributes nothing, and only when neither names one is the class `destructive` (O6). A value that is not one of the four reads as `destructive`. The `exec` class is removed from the manifest type.
+- **Pins.** `NATIVE_PINS` is the one place the probed versions are written: Kimi 2.3.2 (`Kimi Code CLI`), Qwen 0.26.1 (`qwen-code`), Codex 0.166.0. A listing on any other version is empty. The repository's Codex pin is 0.154.0, so a pinned Codex lists nothing until a receipt covers it; this is intended and shown in `ahub help capabilities`.
+- **ACP lists belong to a session.** The `available_commands_update` of the current session is kept whatever the turn state. One that arrives before `session/new` is answered waits and counts only when it names the session that was bound; one for another session is dropped. A restart clears the list. An offline peer lists nothing.
+- **Codex.** `skills/list { cwds: [project], forceReload: false }` goes through the attached app-server connection with a hub id, so the TUI never sees the answer. Enabled skills only; the short description is used when there is one. An unattached, offline or unanswered peer rejects, which the daemon shows as no list.
+- **Config.** `invocation` is a machine-local block validated by the closed schema (`invocation.share` only in C1; `timeout_s` arrives with C2) and applies live. `hub_capabilities` reads the share from the running config on every call.
+- **Tools.** `hub_capabilities { peer? }` is a read tool, exposed to read-only projects; it needs no task and no approval. `hub_capabilities_publish { capabilities }` is the source for a session the hub cannot read natively: a peer whose adapter implements `capabilityManifest` is refused, every field is checked, an unknown field refuses the whole call, the invoke form is forced to `prompt`, the list replaces the last one and is bound to the publishing connection (the daemon's connection generation), and it is dropped when the peer goes offline. Both calls are refused during a PII turn and for a peer holding PII, and neither is captured to memory (`CAPABILITY_TOOLS`).
+- **The person's view.** `ahub capabilities` (op `capabilities_list`, Console only, no `CONDUCTOR_TASK_OPS` entry) shows every found entry with its state (`listed`, `unshared` or `digest-changed`) and the class that would apply, for every peer, shared or not. The audit label is `capabilities` with no argument echoed.
+- **Not decided here.** Whether a Codex skill can be run through a `skill` turn item, and how a Kimi or Qwen `/name input` behaves under a real login, stay C0's unverified list and move to C2 and C4.
+
+### C2 as built (#445, task 179)
+
+C2 runs `read` invocations end to end. `write` and `external` stay refused (the person-approval path is C3) and `destructive` is refused for good (O3). These points are where the build fixes or differs from the freeze.
+
+- **Where.** `src/hub/invocations.ts` holds the pure gates (`invocationRefusal`), the argument check (`checkArgs`), the two texts the hub writes (`requestText`, `renderInvocationResult`), `refusedBy` and the `InvocationLedger`. The daemon's `hub_invoke` branch sits beside the C1 capability tools in `taskOpBody`. Adapters are unchanged.
+- **Every invocation is a model-mediated request in C2.** The freeze's `invoke: native` form (the target's own `/name input` path, a Codex `skill` turn item) is not implemented: it needs a live account to verify and is C4. The target is handed one hub-written envelope naming the caller and the capability, and answers it as an ordinary turn under its own permissions and sandbox. `invoke: native` capabilities are therefore invocable only as that request, and the request says so.
+- **Transport.** The request is an envelope from the hub to the target alone (`kind: invocation`, `priority: status`, `refs.invocation` = its own id). The callee's answer is taken over inside the bus, before anything is built from it (`Bus.onAnswer`): it is recognised by what the peer was handed (a delivery holding an `invocation` request) when it names that request, or names no parent while that invocation's own turn remains open, never by its recipient address. Once the turn ends, an unnamed later message is ordinary traffic and is published; an explicit late or repeated reply naming the request remains captured and dropped. Important messages are not steered into the invocation's open turn, so they cannot change its reply parent. A headless agent whose final answer is normally shared with every sender therefore cannot leak that invocation's answer. A taken answer is published nowhere, stored nowhere and emitted in no event, so no tap, queue, digest, recall preface, journal row or memory path sees it, and a late or repeated answer is dropped rather than broadcast. The daemon settles the row and publishes ONE `invocation_result` from the hub to the caller only, with a hub-written first line, the callee's text sanitized (a forged hub header is quoted) and cut to 8 KiB by code point. An explicit `hub_send` with `reply_to` the request is the same answer. A reply starting `[REFUSED]` is `refused`. The id of the request, the ledger row and the result are one id. Both kinds are in `KINDS` (`envelope.ts`), which the journal, the restart reader, the deferred-notice check and the held-delivery hints all read.
+- **Alone, never condensed.** `Bus.take` and `Bus.takeBudget` end a batch at an invocation or result envelope, and never put one beside another. The daemon's tap handles these envelopes first and returns, so no log line carries a body and no memory citation sees one.
+- **Gates, all before any envelope, one reason each.** Order: PII context, depth, own capability, off roster, offline, paused, held, pull-only, no shared capability (an unshared entry and a missing one read the same, so an agent learns nothing about what the person withheld), digest changed, destructive, write or external (C3), task not yours or PII, per-caller and per-target open caps (4 and 8). Then the arguments against the capability's flat schema (a native form refuses a newline), then the Tasks pattern check and, when the screen is on, the model screen on free-text arguments, with unknown refused. Every fact is read again after that await and the gates run again. Depth is the target holding a `delivered` row: the caller of a nested invocation is the target of an open one.
+- **Result privacy.** The callee's answer goes through the pattern check, the secret check, the path policy and, when `signals.pii_screen` is on, the model screen, with unknown treated as PII, and it is checked again after that await. The full answer is screened, rather than only its shortened refusal reason, before any reason is forwarded. If the callee's turn is private (`turns.get(target).private`, `contextPii`) or the scoped task is PII, or any check does not clear it, an answer starting `[REFUSED]` retains outcome `refused` and returns only the fixed reason `<target> declined; the reason was withheld`; no callee text is kept. An ordinary unsafe answer retains outcome `withheld` and its existing fixed text, with no body kept anywhere. Unknown or a screen failure follows the same refusal-versus-ordinary distinction; a clean refusal retains its screened reason.
+- **Pause and budget.** A target paused by the person, the conductor or the budget, or whose quota window is exhausted, is refused at call time. A pause that starts while the request is queued leaves it queued under its deadline. The caller is charged the ordinary per-sender and per-pair limits as for a message to the target (the request itself is a hub envelope, which no limit applies to), and every invocation is `priority: status`.
+- **Deadline and receipts.** `invocation.timeout_s` (10 to 86400, default 600). A 5 s sweep (`invocationSweepMs` is a test seam) withdraws a request whose ledger row is `queued` and that is still waiting in the target's delivery queue at its deadline (`expired`, no effect). A ledger row can still say `queued` after its request was handed over but before the adapter reports acceptance; if the request is no longer in that queue, it may already be running and receives `timeout`, as does a `delivered` read with no result. The bus marks a row `delivered` from `onDelivered` (actual transport admission) and the daemon settles it `failed` on `undeliverable`. A row settles once, so a late answer after a timeout changes nothing. The freeze's one redelivery of a read after a `failed_safe` receipt is the bus's own retry (it requeues the original, at most `bus.max_attempts` times) rather than a second mechanism.
+- **Record.** The `invocations` table in `hub.db` holds ids, digest, class, task, a digest of the arguments, outcome, times and result bytes, never an argument or a result. An ids-only `invocation` event is written at queue and at settle. `hub_invoke` joins the capture skip list. The task history entry (`Tasks.recordInvocation`) is C3, with the first call that can change something.
+- **Feature flag.** `invocation` is in `DAEMON_FEATURES`. The Claude plugin refuses `hub_invoke` with a clear message against a hub without it, and recovery refuses a target without the feature while any invocation row is open. `PROTOCOL` stays 16.
+- **Not in C2.** The `invoke` hub capability is a name in `capabilities.<peer>` and defaults on, as every other (an unlisted peer has all of them). Per-class gates beyond read, the approval path, `personOnly`, the PII task refusals for write, and every live receipt are C3 and C4.
+
+
+
+### C3 as built (#445, task 180)
+
+- Write/external admission requires an open non-PII task whose owner or reviewer is the caller. Unattended refuses before prompting. Destructive remains refused. Person approval uses allow-once/deny only; the existing native forceAsk policy is unchanged.
+- The person-only prompt names caller, target, capability digest, effective class, task and arguments digest. It also shows screened, sanitized arguments, at most 200 Unicode characters per value, marked when cut. The prompt is available through the authenticated console/dashboard permission path; no argument preview is logged, emitted as an event, placed in task history or returned in a peer-visible permission view.
+- Admission rechecks session generations, current capability/share/digest/class, task scope/privacy, turn privacy, roster, pause/hold, depth, open caps and shutdown after asynchronous screens/approval. A changed binding refuses the call; an approval never follows a changed task or capability.
+- Control requests for `hub_invoke` cover the supported 3600-second approval ceiling plus admission/transport margin. MCP cancellation and client abandonment cancel only that connection's pending request; closing its control connection aborts the pending permission. Current admission checks the abort fence after every await, so a late allow cannot dispatch a disconnected or abandoned call. An already admitted native turn is never cancelled through this path.
+- The existing ledger approval column stores the actual person approval id. Task-scoped calls record queued metadata through host-only `Tasks.recordInvocation` before publication, and terminal metadata after settle-once. History carries ids, digests, class, approval and outcome only; it changes no task state and emits no task notification. A failed queued audit prevents delivery.
+- Only a `read` may automatically redeliver, at most once and only after `failed_safe`, independent of `bus.max_attempts`. Write/external safe refusal ends failed without replay; an ambiguous receipt, thrown handoff, restored uncertain delivery or delivered deadline is `needs_review` and holds the journal. Recipient retry cannot replay invocation requests; the person's existing queue resolution remains explicit. A queued request never handed over still expires without effect.
+- Capability execution remains model-mediated under the callee's own sandbox and permissions. Native forms, live-account execution and C4 receipts are not supplied by this change.
+
+
+## Amendment: shipped writing, analysis and ops packs (#513b)
+
+The writing domain pack is named `writing-pack` (base `writing`), preserving the existing rule that a pack cannot shadow a profile. `analysis` uses `research` and the existing analyst role; `ops` uses `general`. The catalog adds four original writing roles (editor, translator, style-checker, terminology-checker) and two original ops roles (project-manager, meeting-actions-owner). Their guidance grants no authority, and pack loading does not assign peers automatically.
+
+Each pack supplies criterion ids in its rubric and exactly one advisory check entry. Standalone examples in `templates/checks/` validate writing JSON metadata/literal terminology/mechanical style, rerun an explicitly selected analysis program twice against declared input/expected bytes, or validate meeting-action owner/due/status records. They are shipped with synthetic fixtures, not executed by init or by parsing pack data. The existing person-owned `checks` policy is still the only way to select a task command. Inputs are bounded to 1 MiB, analysis runs to 5 seconds and 1 MiB stdout each, and errors never echo artifact contents. Checks emit criterion ids and a deterministic final result; semantic quality, meeting coverage and undeclared analysis dependencies remain reviewer judgments. `docs/profiles.md` records exact invocations, formats and limits. The role inventory lint compares every template group with the bundled registry rather than assuming the first eleven definitions. No live adoption or native model ingestion is claimed.

package/docs/verification/2026-10-30-0.23.0.md

@@ -0,0 +1,70 @@
+# 0.23.0 release verification
+
+This record covers release preparation and source review. It claims no installation, no running-hub upgrade to 0.23.0 and no live TUI launch.
+
+## Candidate
+
+Version 0.23.0, prepared from main 2dbd4853 (11 commits since v0.22.0, 8 of them `feat`; bump rule: minor). The release commits carry the version, the CHANGELOG section, the bundle and the documentation stamps.
+
+## Reviews
+
+Pull requests named by the commits since v0.22.0: #993, #992, #991, #990, #989, #986, #987, #567, #988, #985, #984, #982.
+
+Every one merged with exact-head CI green and no unresolved review thread. The conductor (claude) read each hub approval in `hub.db` and compared its head with the merged head:
+
+- Merged at the approved head: #993 (task 322, ae6900e6), #990 (task 572, 58ba2e2b), #988 (task 567, 104d5eb5).
+- Merged after the conductor re-reviewed a follow-up diff on top of the approved head, because the hub refuses a second approval of an approved task:
+  - #992 (task 187): approved d1bcf22c, merged e492e359. The follow-up sorts the remote argument keys, a connector P2.
+  - #991 (task 180): approved 4b54d96f, merged 17c3df2a. The follow-up gives `hub_invoke` an approval-sized control timeout with cancellation, a connector P2.
+- Merged after a rebase whose `git range-diff` against the approved head shows no code change:
+  - #987 (task 448): approved 6bae3153, merged 8452d254; every commit is identical.
+  - #986 (task 179): approved 08096575, merged 5920c228; one commit message differs.
+  - #984 (task 447): approved eaeeb7b2, merged 1f8e3d7a. The H5 commits dropped out after #982 merged, and the H6 commit is identical.
+  - #982 (task 446): approved 473d0d63, merged 90643007; one `docs/operations.md` conflict hunk was resolved in the release rebase.
+  - #985 (task 178): approved 5e2fccba, merged f21fe4fb. The rebase added one docs-only commit (the `acpManifest` comment and the parser location in the spec) and rebuilt the bundle.
+- #989 is docs only (the #489 disposition, Fixes #489), with no hub task; claude reviewed it on the PR before the merge.
+
+Release merge: #994 merged release/0.23.0 at 18947c14 with a merge commit, c3e322f4, so the stamp commit ce8da3ec is an ancestor of main. It was given a custom subject (`Merge release 0.23.0 (#994)`). `scripts/release-tag.ts` accepts only the default `Merge pull request #N from <owner>/release/0.23.0` subject, so it refused that commit. This note is carried by a second release PR merged with the default subject, and the tag goes on that merge commit; no history was rewritten and no guard was changed. The connector's P1 on #994 (stamps not in the ancestry) did not apply: it reviewed a squashed view (3c7b0aa) that is not in the branch history.
+
+## Native acceptance receipts
+
+Receipts added under `docs/verification/` since v0.22.0: `docs/verification/2026-10-30-adapter-operational-settings.md`, `docs/verification/2026-10-30-model-operational-settings.md`, `docs/verification/2026-10-30-operational-settings-closure.md`, `docs/verification/2026-10-30-ui-console-operational-settings.md`.
+
+This list is read from the repository, never written by hand. Native acceptance and the person's release consent are separate records: consent is `ahub sdlc authorize-release 0.23.0`, person only, and is not recorded in this file. The tag run refuses without it.
+
+## Document review
+
+`node scripts/check-docs.mjs --require-fresh` reported 15 stale documents. Each was checked against its source commits since its stamp (cb942e06, or aeeaeb04 and 43867c65 for local-worker.md, models.md and benchmarks.md). The check looked for statements those commits made untrue and for rules an agent editing that area now needs. Every proposed fix was confirmed against the code before it was applied in ce8da3ec, and all 15 were then restamped at ce8da3ec.
+- README.md (9): the report link now names this report. docs/quickstart.md (9): the install pin and a new "Upgrading to 0.23.0" note.
+- docs/operations.md (10): the capabilities listing no longer says invoking is a later slice. The #489 line records the #989 closure. The relay cooldown names the `model_relay.*` settings (the streak resets after twice the cap, `src/models/relay.ts:251`). The `role list` groups and the `init --profile` text name the shipped packs.
+- docs/security.md (9): `invocation` joins the machine-local field list, and the X4 boundary section states what X6 lets cross.
+- src/cli/help.ts (1): the `ahub init` line names the shipped packs. Its watched paths do not include `src/hub/shipped-packs.ts`, so freshness alone would not have caught this.
+- Agent notes:
+  - bus.md: invocation kinds go alone and are never condensed or steered into; the `onAnswer` capture order; no ordinary replay; add a kind only to `KINDS`; `remoteEnvelope` for provenance.
+  - daemon.md: the `invocation` recovery feature floor, next-use and restart settings captured once by their consumer, and the `hub_invoke` socket/`rid` abort binding.
+  - adapters.md: `adapter_timing.*` passed at construction, and native capability listings.
+  - budget.md: the invocation exception to the quota-pause retry rule.
+  - local-worker.md: remote turns are `remoteEnvelope`.
+  - models.md: `model_relay.*` and `inference.backoff_min` are restart-bound.
+  - tasks.md: the `Tasks.recordInvocation` audit rule.
+  - tests.md, benchmarks.md and agent-notes/README.md: no statement changed (#990 had already updated the CI shard lines).
+- The CHANGELOG gained the missing #982, #984, #987, #988, #991, #992 and #993 entries, and the C1 and C2 entries no longer say invocation is a later slice.
+
+## Checks
+
+In the release worktree with its own frozen install (`@staix/agent-mem` 0.13.0):
+- `node scripts/check-docs.mjs --require-fresh` printed `docs: OK (0 stale documents)`.
+- `bun x tsc --noEmit` was clean.
+- `bun scripts/build.mjs --check` exited 0.
+- `node scripts/check-package.mjs` printed `package: OK (673 files, @staix/agent-hub@0.23.0)`.
+
+The release PR's exact-head CI is the full gate on both OSes.
+
+## Known gaps, not blocking
+
+- No new live receipt in this release. #445 C4 (Claude invoking a Kimi command and a Codex skill on a real task, with a person approving) needs this release installed and is task 181. #446 X7 (a live room run on two Macs) is task 188. Still open: #912 AC1, #793 AC6 (task 468: the hub must be restarted with the remote runner), #418 AC8 and #332 AC6.
+- Capability invocation (C1-C3, X6) is proved with fixture peers and two in-process daemons with the real broker and crypto; no native account executed a shared skill.
+- The thirteen new settings were exercised through fixtures and real daemons in tests, never edited live against a running hub.
+- The running hub on this machine is 0.20.0; no `ahub upgrade` to 0.23.0 has run.
+- The Bun pin stays 1.4.2: 1.4.4 is under two weeks old until 2026-11-05 (task 565).
+- The full `scripts/check.sh` was not run locally; the release PR's CI runs it on both OSes.

package/docs/verification/2026-10-30-adapter-operational-settings.md

@@ -0,0 +1,261 @@
+# H5 adapters and handshakes: H0 ledger
+
+Reconciliation for #489 group 4. H0 coordinates are frozen inventory locations, not current source line claims. Source audit used main `b974320742752e1d39827cc5c2e39510367444ab`; implementation is based on merged H4 `0c15f546353343c6193bfd33465e55e8ef37daa8`.
+
+The complete area has **232 unique identities**: 96 operational, 96 safety floors, 30 contracts and 10 test seams. The detailed inventory has 259 occurrences; duplicate display rows are counted once. The `src/adapters/` subset contains 154 identities, and all 78 support/benchmark identities are included below.
+
+**3 identities are converted; 229 are excluded**, each with its reason. All use the H1 fixed descriptor/schema/settings/default mechanism in the existing config store. The namespace `adapter_timing` avoids the executable declaration map `adapters`.
+
+| Setting | Bounds | Default | Apply boundary |
+| --- | --- | --- | --- |
+| `adapter_timing.acp_tool_ceiling_min` | 1-30 min | 30 min | next peer launch; effective `max(watchdogMs, ceiling)` and remaining-only rearm |
+| `adapter_timing.acp_activity_batch_ms` | 10-50 ms | 50 ms | next peer launch; no retiming of pending activity batches; existing privacy/text caps |
+| `adapter_timing.jcode_steer_timeout_s` | 5-60 s | 5 s | next Jcode launch; one captured deadline for all native steer phases |
+
+ACP startup/mode/cancel and Jcode readiness remain fixed at 30 seconds. The 65/70-second caller budgets leave no useful raise-only startup range without changing those callers. The MCP reconnect cap remains fixed at 30 seconds; the plugin has no accepted config access and this conversion adds no cross-process projection seam. The unmanaged recovery window retains its existing relationship to that cap.
+
+## Full identity ledger
+
+Each row is one unique JSON identity. H0 classification is retained as evidence; disposition reevaluates its actual runtime role.
+
+| Stable identity | Frozen H0 location(s) | H0 class | Disposition | Reason |
+| --- | --- | --- | --- | --- |
+| `scripts/benchmarks/native-pi-qwen.ts:<anonymous>:inline:String(e).slice=200#0` | scripts/benchmarks/native-pi-qwen.ts:1684:99, scripts/benchmarks/native-pi-qwen.ts:1691:105, scripts/benchmarks/native-pi-qwen.ts:1706:113, scripts/benchmarks/native-pi-qwen.ts:1715:151 | safety floor | Excluded: benchmark safety | Benchmark-only <anonymous>/String(e).slice bounds diagnostic text, tool text or source-inventory inspection; never expand through H5 settings. |
+| `scripts/benchmarks/native-pi-qwen.ts:<anonymous>:inline:String(s.reason).slice=200#0` | scripts/benchmarks/native-pi-qwen.ts:1129:89 | safety floor | Excluded: benchmark safety | Benchmark-only <anonymous>/String(s.reason).slice bounds diagnostic text, tool text or source-inventory inspection; never expand through H5 settings. |
+| `scripts/benchmarks/native-pi-qwen.ts:ACTIVE_TRACE_CAP:constant:ACTIVE_TRACE_CAP=4096#0` | scripts/benchmarks/native-pi-qwen.ts:802:7 | operational | Excluded: benchmark follow-up | Trace retention for benchmark evidence only, not daemon delivery retention. |
+| `scripts/benchmarks/native-pi-qwen.ts:activeExit:inline:state.quietMs >= 1000=1000#0` | scripts/benchmarks/native-pi-qwen.ts:727:43 | operational | Excluded: benchmark follow-up | Benchmark quiet-window completion observation, not native session completion authority. |
+| `scripts/benchmarks/native-pi-qwen.ts:allow:inline:a.text.length <= 4000=4000#0` | scripts/benchmarks/native-pi-qwen.ts:1515:137 | safety floor | Excluded: benchmark safety | Benchmark-only allow/a.text.length <= 4000 bounds diagnostic text, tool text or source-inventory inspection; never expand through H5 settings. |
+| `scripts/benchmarks/native-pi-qwen.ts:arm:inline:Bun.sleep=100#0` | scripts/benchmarks/native-pi-qwen.ts:1603:37, scripts/benchmarks/native-pi-qwen.ts:1665:33 | operational | Excluded: benchmark follow-up | Benchmark setup/readiness polling, not a daemon peer-start policy. |
+| `scripts/benchmarks/native-pi-qwen.ts:arm:inline:Bun.sleep=100#1` | scripts/benchmarks/native-pi-qwen.ts:1603:37, scripts/benchmarks/native-pi-qwen.ts:1665:33 | operational | Excluded: benchmark follow-up | Benchmark setup/readiness polling, not a daemon peer-start policy. |
+| `scripts/benchmarks/native-pi-qwen.ts:arm:inline:Bun.sleep=25#0` | scripts/benchmarks/native-pi-qwen.ts:1557:47 | operational | Excluded: benchmark follow-up | Benchmark setup/readiness polling, not a daemon peer-start policy. |
+| `scripts/benchmarks/native-pi-qwen.ts:arm:inline:String(e).slice=200#0` | scripts/benchmarks/native-pi-qwen.ts:1684:99, scripts/benchmarks/native-pi-qwen.ts:1691:105, scripts/benchmarks/native-pi-qwen.ts:1706:113, scripts/benchmarks/native-pi-qwen.ts:1715:151 | safety floor | Excluded: benchmark safety | Benchmark-only arm/String(e).slice bounds diagnostic text, tool text or source-inventory inspection; never expand through H5 settings. |
+| `scripts/benchmarks/native-pi-qwen.ts:arm:inline:String(e).slice=200#1` | scripts/benchmarks/native-pi-qwen.ts:1684:99, scripts/benchmarks/native-pi-qwen.ts:1691:105, scripts/benchmarks/native-pi-qwen.ts:1706:113, scripts/benchmarks/native-pi-qwen.ts:1715:151 | safety floor | Excluded: benchmark safety | Benchmark-only arm/String(e).slice bounds diagnostic text, tool text or source-inventory inspection; never expand through H5 settings. |
+| `scripts/benchmarks/native-pi-qwen.ts:arm:inline:String(e).slice=200#2` | scripts/benchmarks/native-pi-qwen.ts:1684:99, scripts/benchmarks/native-pi-qwen.ts:1691:105, scripts/benchmarks/native-pi-qwen.ts:1706:113, scripts/benchmarks/native-pi-qwen.ts:1715:151 | safety floor | Excluded: benchmark safety | Benchmark-only arm/String(e).slice bounds diagnostic text, tool text or source-inventory inspection; never expand through H5 settings. |
+| `scripts/benchmarks/native-pi-qwen.ts:arm:inline:qv.slice=80#0` | scripts/benchmarks/native-pi-qwen.ts:1242:127, scripts/benchmarks/native-pi-qwen.ts:1417:131 | safety floor | Excluded: benchmark safety | Benchmark-only arm/qv.slice bounds diagnostic text, tool text or source-inventory inspection; never expand through H5 settings. |
+| `scripts/benchmarks/native-pi-qwen.ts:batchMs:inline:batchMs=0#0` | scripts/benchmarks/native-pi-qwen.ts:1387:44 | operational | Excluded: benchmark follow-up | Benchmark-local delivery batching input, not the production Bus descriptor. |
+| `scripts/benchmarks/native-pi-qwen.ts:cmd:inline:stderr.slice=300#0` | scripts/benchmarks/native-pi-qwen.ts:1101:78, scripts/benchmarks/native-pi-qwen.ts:1142:75 | safety floor | Excluded: benchmark safety | Benchmark-only cmd/stderr.slice bounds diagnostic text, tool text or source-inventory inspection; never expand through H5 settings. |
+| `scripts/benchmarks/native-pi-qwen.ts:cmd:inline:timeoutMs=180_000#0` | scripts/benchmarks/native-pi-qwen.ts:1138:62 | test seam | Excluded: benchmark seam | Benchmark-only cmd/timeoutMs bounds fixture deadline injection; no production setting. |
+| `scripts/benchmarks/native-pi-qwen.ts:contextWindow:inline:contextWindow=262144#0` | scripts/benchmarks/native-pi-qwen.ts:1438:121 | operational | Excluded: benchmark follow-up | Benchmark synthetic model declaration; not observed native context admission. |
+| `scripts/benchmarks/native-pi-qwen.ts:effectiveBuild:inline:stderr.slice=300#0` | scripts/benchmarks/native-pi-qwen.ts:1101:78, scripts/benchmarks/native-pi-qwen.ts:1142:75 | safety floor | Excluded: benchmark safety | Benchmark-only effectiveBuild/stderr.slice bounds diagnostic text, tool text or source-inventory inspection; never expand through H5 settings. |
+| `scripts/benchmarks/native-pi-qwen.ts:error:inline:String(e).slice=300#0` | scripts/benchmarks/native-pi-qwen.ts:1779:678, scripts/benchmarks/native-pi-qwen.ts:1784:110 | safety floor | Excluded: benchmark safety | Benchmark-only error/String(e).slice bounds diagnostic text, tool text or source-inventory inspection; never expand through H5 settings. |
+| `scripts/benchmarks/native-pi-qwen.ts:error:inline:String(e).slice=300#1` | scripts/benchmarks/native-pi-qwen.ts:1779:678, scripts/benchmarks/native-pi-qwen.ts:1784:110 | safety floor | Excluded: benchmark safety | Benchmark-only error/String(e).slice bounds diagnostic text, tool text or source-inventory inspection; never expand through H5 settings. |
+| `scripts/benchmarks/native-pi-qwen.ts:error:inline:error.replace(/(token\|secret\|api[_-]?key)(\s*[:=]\s*)[^\s,;]+/gi, $1$2[redacted]).slice=300#0` | scripts/benchmarks/native-pi-qwen.ts:1746:125 | safety floor | Excluded: benchmark safety | Benchmark-only error/error.replace(/(token|secret|api[_-]?key)(\s*[:=]\s*)[^\s,;]+/gi, $1$2[redacted]).slice bounds diagnostic text, tool text or source-inventory inspection; never expand through H5 settings. |
+| `scripts/benchmarks/native-pi-qwen.ts:executeTool:inline:String(a.text).slice=4000#0` | scripts/benchmarks/native-pi-qwen.ts:1395:77, scripts/benchmarks/native-pi-qwen.ts:1472:87 | safety floor | Excluded: benchmark safety | Benchmark-only executeTool/String(a.text).slice bounds diagnostic text, tool text or source-inventory inspection; never expand through H5 settings. |
+| `scripts/benchmarks/native-pi-qwen.ts:failureClass:inline:reason.slice=300#0` | scripts/benchmarks/native-pi-qwen.ts:697:64 | safety floor | Excluded: benchmark safety | Benchmark-only failureClass/reason.slice bounds diagnostic text, tool text or source-inventory inspection; never expand through H5 settings. |
+| `scripts/benchmarks/native-pi-qwen.ts:fetch:inline:String(a.text).slice=4000#0` | scripts/benchmarks/native-pi-qwen.ts:1395:77, scripts/benchmarks/native-pi-qwen.ts:1472:87 | safety floor | Excluded: benchmark safety | Benchmark-only fetch/String(a.text).slice bounds diagnostic text, tool text or source-inventory inspection; never expand through H5 settings. |
+| `scripts/benchmarks/native-pi-qwen.ts:main:inline:qv.slice=80#0` | scripts/benchmarks/native-pi-qwen.ts:1242:127, scripts/benchmarks/native-pi-qwen.ts:1417:131 | safety floor | Excluded: benchmark safety | Benchmark-only main/qv.slice bounds diagnostic text, tool text or source-inventory inspection; never expand through H5 settings. |
+| `scripts/benchmarks/native-pi-qwen.ts:maxTokens:inline:maxTokens=4096#0` | scripts/benchmarks/native-pi-qwen.ts:1438:140 | operational | Excluded: benchmark follow-up | Benchmark inference request budget, not adapter handshake latency. |
+| `scripts/benchmarks/native-pi-qwen.ts:max_tokens:inline:max_tokens=20#0` | scripts/benchmarks/native-pi-qwen.ts:1367:149 | operational | Excluded: benchmark follow-up | Benchmark tiny probe output budget, not production model policy. |
+| `scripts/benchmarks/native-pi-qwen.ts:minimum:inline:minimum=1#0` | scripts/benchmarks/native-pi-qwen.ts:152:198, scripts/benchmarks/native-pi-qwen.ts:152:238 | contract | Excluded: benchmark contract | Benchmark-only minimum/minimum bounds required invocation count; not a runtime setting. |
+| `scripts/benchmarks/native-pi-qwen.ts:minimum:inline:minimum=1#1` | scripts/benchmarks/native-pi-qwen.ts:152:198, scripts/benchmarks/native-pi-qwen.ts:152:238 | contract | Excluded: benchmark contract | Benchmark-only minimum/minimum bounds required invocation count; not a runtime setting. |
+| `scripts/benchmarks/native-pi-qwen.ts:observe:inline:this.calls.size > 128=128#0` | scripts/benchmarks/native-pi-qwen.ts:446:38 | operational | Excluded: benchmark follow-up | Benchmark outstanding-call evidence retention; changing it would alter measurement. |
+| `scripts/benchmarks/native-pi-qwen.ts:onUsageDiagnostic:inline:qwenUsageDiagnostics.length < 32=32#0` | scripts/benchmarks/native-pi-qwen.ts:1509:89 | operational | Excluded: benchmark follow-up | Benchmark usage diagnostic sample retention, not native quota policy. |
+| `scripts/benchmarks/native-pi-qwen.ts:signal:inline:AbortSignal.timeout=30_000#0` | scripts/benchmarks/native-pi-qwen.ts:1367:185 | operational | Excluded: benchmark follow-up | Benchmark fetch deadline, not production native startup. |
+| `scripts/benchmarks/native-pi-qwen.ts:text:inline:clean(s).slice=500#0` | scripts/benchmarks/native-pi-qwen.ts:1510:75 | safety floor | Excluded: benchmark safety | Benchmark-only text/clean(s).slice bounds diagnostic text, tool text or source-inventory inspection; never expand through H5 settings. |
+| `scripts/benchmarks/native-pi-qwen.ts:timer:inline:opts.timeoutMs ?? 60_000=60_000#0` | scripts/benchmarks/native-pi-qwen.ts:1099:115 | test seam | Excluded: benchmark seam | Benchmark-only timer/opts.timeoutMs ?? 60_000 bounds fixture deadline injection; no production setting. |
+| `scripts/benchmarks/native-pi-qwen.ts:title:inline:clean(String(u.title ?? )).slice=350#0` | scripts/benchmarks/native-pi-qwen.ts:1585:115 | safety floor | Excluded: benchmark safety | Benchmark-only title/clean(String(u.title ?? )).slice bounds diagnostic text, tool text or source-inventory inspection; never expand through H5 settings. |
+| `scripts/benchmarks/native-pi-qwen.ts:title:inline:clean(req.title).slice=900#0` | scripts/benchmarks/native-pi-qwen.ts:1523:99 | safety floor | Excluded: benchmark safety | Benchmark-only title/clean(req.title).slice bounds diagnostic text, tool text or source-inventory inspection; never expand through H5 settings. |
+| `scripts/benchmarks/native-pi-qwen.ts:verifySurfaceSource:inline:entries.length > 32=32#0` | scripts/benchmarks/native-pi-qwen.ts:199:45 | safety floor | Excluded: benchmark safety | Benchmark-only verifySurfaceSource/entries.length > 32 bounds diagnostic text, tool text or source-inventory inspection; never expand through H5 settings. |
+| `scripts/benchmarks/native-pi-qwen.ts:watchdogMs:inline:watchdogMs=300_000#0` | scripts/benchmarks/native-pi-qwen.ts:1442:48, scripts/benchmarks/native-pi-qwen.ts:1502:33 | operational | Excluded: benchmark follow-up | Benchmark-owned peer inactivity input; keep benchmark calibration separate. |
+| `scripts/benchmarks/native-pi-qwen.ts:watchdogMs:inline:watchdogMs=300_000#1` | scripts/benchmarks/native-pi-qwen.ts:1442:48, scripts/benchmarks/native-pi-qwen.ts:1502:33 | operational | Excluded: benchmark follow-up | Benchmark-owned peer inactivity input; keep benchmark calibration separate. |
+| `src/adapters/acp-owned-group.ts:READ_MS:constant:READ_MS=1000#0` | src/adapters/acp-owned-group.ts:18:7 | operational | Excluded: process proof/cleanup | READ_MS/READ_MS bounds process-table proof or validates injected kill grace; preserve same-owner verification and fail-closed cleanup. |
+| `src/adapters/acp-owned-group.ts:stop:inline:killMs > 10_000=10_000#0` | src/adapters/acp-owned-group.ts:62:61 | operational | Excluded: process proof/cleanup | stop/killMs > 10_000 bounds process-table proof or validates injected kill grace; preserve same-owner verification and fail-closed cleanup. |
+| `src/adapters/acp-quota.ts:windowMins:inline:windowMins=300#0` | src/adapters/acp-quota.ts:12:43 | operational | Excluded: provider quota contract | 300minutes is the verified Kimi5h refusal window, not an adapter scheduling preference. |
+| `src/adapters/acp.ts:<anonymous>:inline:activityText(title).replace(/[\p{Cc}\p{Cf}\p{Zl}\p{Zp}]/gu, ).slice=80#0` | src/adapters/acp.ts:516:200 | safety floor | Excluded: ACP input/preview safety | <anonymous>/activityText(title).replace(/[\p{Cc}\p{Cf}\p{Zl}\p{Zp}]/gu, ).slice bounds retained tool inputs or sanitized activity/permission preview text; never expose unbounded private tool input. |
+| `src/adapters/acp.ts:HANDSHAKE_MS:constant:HANDSHAKE_MS=30000#0` | src/adapters/acp.ts:135:7 | operational | Excluded: fixed startup/fallback contract | Ruling3384d552 leaves HANDSHAKE_MS at30s: configured ACP start caller70s, plus coupled mode ACK/cancel proof fallbacks. No startup knob or split in H5. |
+| `src/adapters/acp.ts:TOOL_CEILING_MS:constant:TOOL_CEILING_MS=30 * 60000#0` | src/adapters/acp.ts:138:7 | operational | Converted: acp_tool_ceiling_min | Existing toolCeilingMs host option; total wait ceiling remains max(watchdogMs, configured ceiling) and rearming uses only remaining allowance. |
+| `src/adapters/acp.ts:TOOL_INPUT_CAP:constant:TOOL_INPUT_CAP=64#0` | src/adapters/acp.ts:137:7 | safety floor | Excluded: ACP input/preview safety | TOOL_INPUT_CAP/TOOL_INPUT_CAP bounds retained tool inputs or sanitized activity/permission preview text; never expose unbounded private tool input. |
+| `src/adapters/acp.ts:alive:inline:Math.max=10#0` | src/adapters/acp.ts:721:107 | operational | Excluded: derived liveness | Math.max is a clamp on watchdog/3 heartbeat while approval waits; preserve the watchdog relationship, not independent settings. |
+| `src/adapters/acp.ts:alive:inline:Math.min=30_000#0` | src/adapters/acp.ts:721:120 | operational | Excluded: derived liveness | Math.min is a clamp on watchdog/3 heartbeat while approval waits; preserve the watchdog relationship, not independent settings. |
+| `src/adapters/acp.ts:cut:inline:full.length > 600=600#0` | src/adapters/acp.ts:705:31 | safety floor | Excluded: ACP input/preview safety | cut/full.length > 600 bounds retained tool inputs or sanitized activity/permission preview text; never expose unbounded private tool input. |
+| `src/adapters/acp.ts:input:inline:full.slice=600#0` | src/adapters/acp.ts:706:72 | safety floor | Excluded: ACP input/preview safety | input/full.slice bounds retained tool inputs or sanitized activity/permission preview text; never expose unbounded private tool input. |
+| `src/adapters/acp.ts:updateWatch:inline:setTimeout=50#0` | src/adapters/acp.ts:223:69 | operational | Converted: acp_activity_batch_ms | Coalesces pending activity emission only; configure next peer construction with10..50ms conservative bounds, never recreate a timer already pending. |
+| `src/adapters/acp.ts:updateWatch:inline:this.activityPending.text.length + item.text.length > 4096=4096#0` | src/adapters/acp.ts:220:110 | operational | Excluded: activity buffer safety | 4096-character pending text boundary forces an immediate flush and bounds memory; it is not a batching timeout. |
+| `src/adapters/adapter-api.ts:ADAPTER_API:constant:ADAPTER_API=1#0` | src/adapters/adapter-api.ts:2:14 | contract | Excluded: wire/schema contract | ADAPTER_API/ADAPTER_API defines protocol version, close code, positional arguments, role cardinality, peer tool identity or fixture response assertion; callers must continue interpreting the same value. |
+| `src/adapters/agy/entry.ts:timeout:inline:timeout=5000#0` | src/adapters/agy/entry.ts:59:80 | operational | Excluded: version proof bound | 5s bounds native binary/version probe before launch; preserve bounded output and identity checks. |
+| `src/adapters/agy/hooks.ts:<anonymous>:inline:path.length <= 4096=4096#0` | src/adapters/agy/hooks.ts:16:87 | safety floor | Excluded: hook input safety | <anonymous>/path.length <= 4096 bounds transcript scanning, hook path/name or workspace list before accepting native evidence. |
+| `src/adapters/agy/hooks.ts:cap:inline:cap=4 * 1024 * 1024#0` | src/adapters/agy/hooks.ts:58:17 | safety floor | Excluded: hook input safety | cap/cap bounds transcript scanning, hook path/name or workspace list before accepting native evidence. |
+| `src/adapters/agy/hooks.ts:decodeAgyHook:inline:call.name.length > 128=128#0` | src/adapters/agy/hooks.ts:19:124 | safety floor | Excluded: hook input safety | decodeAgyHook/call.name.length > 128 bounds transcript scanning, hook path/name or workspace list before accepting native evidence. |
+| `src/adapters/agy/hooks.ts:decodeAgyHook:inline:value.transcriptPath.length > 4096=4096#0` | src/adapters/agy/hooks.ts:14:119 | safety floor | Excluded: hook input safety | decodeAgyHook/value.transcriptPath.length > 4096 bounds transcript scanning, hook path/name or workspace list before accepting native evidence. |
+| `src/adapters/agy/hooks.ts:decodeAgyHook:inline:value.workspacePaths.length > 32=32#0` | src/adapters/agy/hooks.ts:15:110 | safety floor | Excluded: hook input safety | decodeAgyHook/value.workspacePaths.length > 32 bounds transcript scanning, hook path/name or workspace list before accepting native evidence. |
+| `src/adapters/agy/hooks.ts:readAgyTranscript:inline:Math.min=window * 2#0` | src/adapters/agy/hooks.ts:59:59 | operational | Excluded: transcript scan arithmetic | 64KiB initial scan and doubling recurrence are capped by4MiB; completion evidence must not depend on a new uncoordinated scan knob. |
+| `src/adapters/agy/hooks.ts:window:inline:window=64 * 1024#0` | src/adapters/agy/hooks.ts:59:23 | operational | Excluded: transcript scan arithmetic | 64KiB initial scan and doubling recurrence are capped by4MiB; completion evidence must not depend on a new uncoordinated scan knob. |
+| `src/adapters/channel-peer.ts:waitForAttach:inline:this.attachmentWaiters.length >= 64=64#0` | src/adapters/channel-peer.ts:39:99 | safety floor | Excluded: attachment safety | Attachment waiter count bounds parked native attachment work; no unbounded attach queue. |
+| `src/adapters/claude-channel.ts:<anonymous>:inline:2 ** Math.max(attempt, 0)=2#0` | src/adapters/claude-channel.ts:256:62, src/adapters/claude-channel.ts:317:60 | operational | Excluded: backoff arithmetic | Base1s and factor2 form exponential recurrence under the shared cap; do not add independent duplicate knobs. |
+| `src/adapters/claude-channel.ts:<anonymous>:inline:2 ** Math.max(attempt, 0)=2#1` | src/adapters/claude-channel.ts:256:62, src/adapters/claude-channel.ts:317:60 | operational | Excluded: backoff arithmetic | Base1s and factor2 form exponential recurrence under the shared cap; do not add independent duplicate knobs. |
+| `src/adapters/claude-channel.ts:<anonymous>:inline:Math.min=1000#0` | src/adapters/claude-channel.ts:256:55, src/adapters/claude-channel.ts:317:53 | operational | Excluded: backoff arithmetic | Base1s and factor2 form exponential recurrence under the shared cap; do not add independent duplicate knobs. |
+| `src/adapters/claude-channel.ts:<anonymous>:inline:Math.min=1000#1` | src/adapters/claude-channel.ts:256:55, src/adapters/claude-channel.ts:317:53 | operational | Excluded: backoff arithmetic | Base1s and factor2 form exponential recurrence under the shared cap; do not add independent duplicate knobs. |
+| `src/adapters/claude-channel.ts:<anonymous>:inline:setTimeout=1000#0` | src/adapters/claude-channel.ts:333:86 | operational | Excluded: bounded metadata retry | <anonymous>/setTimeout is the two-attempt1s ListTools/lifecycle reannouncement retry, not reconnect authority or peer adoption. |
+| `src/adapters/claude-channel.ts:HELD_CLOSE:constant:HELD_CLOSE=4000#0` | src/adapters/claude-channel.ts:103:7 | contract | Excluded: wire/schema contract | HELD_CLOSE/HELD_CLOSE defines protocol version, close code, positional arguments, role cardinality, peer tool identity or fixture response assertion; callers must continue interpreting the same value. |
+| `src/adapters/claude-channel.ts:INBOX_CAP:constant:INBOX_CAP=200#0` | src/adapters/claude-channel.ts:105:7 | safety floor | Excluded: offline inbox safety | Plugin inbox count bounds retained disconnected envelopes; no new storage/retention authority. |
+| `src/adapters/claude-channel.ts:MAX_RECONNECT_DELAY_MS:constant:MAX_RECONNECT_DELAY_MS=30000#0` | src/adapters/claude-channel.ts:91:7 | operational | Excluded: reconnect ruling | Ruling3384d552 refuses reconnect conversion under any name. Preserve fixed30s cap, both loops and upgrade coupling; add no status projection, policy reader or other seam. |
+| `src/adapters/claude-channel.ts:callTool:inline:args.tool_use_id.length > 256=256#0` | src/adapters/claude-channel.ts:401:104 | contract | Excluded: wire/schema contract | callTool/args.tool_use_id.length > 256 defines protocol version, close code, positional arguments, role cardinality, peer tool identity or fixture response assertion; callers must continue interpreting the same value. |
+| `src/adapters/claude-channel.ts:callTool:inline:res.pollingAdvice.count >= 3=3#0` | src/adapters/claude-channel.ts:424:92 | contract | Excluded: wire/schema contract | callTool/res.pollingAdvice.count >= 3 defines protocol version, close code, positional arguments, role cardinality, peer tool identity or fixture response assertion; callers must continue interpreting the same value. |
+| `src/adapters/claude-channel.ts:callTool:inline:res.pollingAdvice.minutes <= 10=10#0` | src/adapters/claude-channel.ts:424:212 | contract | Excluded: wire/schema contract | callTool/res.pollingAdvice.minutes <= 10 defines protocol version, close code, positional arguments, role cardinality, peer tool identity or fixture response assertion; callers must continue interpreting the same value. |
+| `src/adapters/claude-channel.ts:reannounce:inline:tries < 2=2#0` | src/adapters/claude-channel.ts:333:44 | operational | Excluded: bounded metadata retry | reannounce/tries < 2 is the two-attempt1s ListTools/lifecycle reannouncement retry, not reconnect authority or peer adoption. |
+| `src/adapters/claude-implementer.ts:maxFrameBytes:inline:maxFrameBytes=4096#0` | src/adapters/claude-implementer.ts:57:107 | safety floor | Excluded: bounded native output | maxFrameBytes/maxFrameBytes caps diff, frame or total child output; existing per-child host options remain bounded rather than configurable upward globally. |
+| `src/adapters/claude-implementer.ts:maxOutputBytes:inline:maxOutputBytes=4096#0` | src/adapters/claude-implementer.ts:57:129 | safety floor | Excluded: bounded native output | maxOutputBytes/maxOutputBytes caps diff, frame or total child output; existing per-child host options remain bounded rather than configurable upward globally. |
+| `src/adapters/claude-implementer.ts:timer:inline:setTimeout=3000#0` | src/adapters/claude-implementer.ts:59:91 | operational | Excluded: native reviewer proof | Bounded version/print proof uses isolated child/environment and awaits cleanup; not ordinary conversation timeout. |
+| `src/adapters/claude-print-child.ts:frameLimit:inline:options.maxFrameBytes ?? 256 * 1024=256 * 1024#0` | src/adapters/claude-print-child.ts:45:49 | safety floor | Excluded: bounded native output | frameLimit/options.maxFrameBytes ?? 256 * 1024 caps diff, frame or total child output; existing per-child host options remain bounded rather than configurable upward globally. |
+| `src/adapters/claude-print-child.ts:outputLimit:inline:options.maxOutputBytes ?? 4 * 1024 * 1024=4 * 1024 * 1024#0` | src/adapters/claude-print-child.ts:45:101 | safety floor | Excluded: bounded native output | outputLimit/options.maxOutputBytes ?? 4 * 1024 * 1024 caps diff, frame or total child output; existing per-child host options remain bounded rather than configurable upward globally. |
+| `src/adapters/claude-print.ts:DIFF_CAP:constant:DIFF_CAP=100000#0` | src/adapters/claude-print.ts:49:7 | safety floor | Excluded: bounded native output | DIFF_CAP/DIFF_CAP caps diff, frame or total child output; existing per-child host options remain bounded rather than configurable upward globally. |
+| `src/adapters/claude-print.ts:timeout:inline:timeout=15_000#0` | src/adapters/claude-print.ts:57:224 | operational | Excluded: metadata proof group | 15s Git diff read supports bounded review/private screening; do not create adapter-level Git budget alongside metadata policy. |
+| `src/adapters/codex-appserver.ts:<anonymous>:inline:this.opts.steerTimeoutMs ?? 10_000=10_000#0` | src/adapters/codex-appserver.ts:316:42, src/adapters/codex-appserver.ts:355:116 | operational | Excluded: existing host seam | Existing steerTimeoutMs already controls ACK wait; no second generic deadline in this H5 slice. |
+| `src/adapters/codex-appserver.ts:adopt:inline:this.opts.usagePollMs ?? 600_000=600_000#0` | src/adapters/codex-appserver.ts:678:84 | operational | Excluded: already configured | Daemon supplies usagePollMs from budget.poll_min; preserve that single accepted configuration authority. |
+| `src/adapters/codex-appserver.ts:alive:inline:Math.max=10#0` | src/adapters/codex-appserver.ts:635:77 | operational | Excluded: derived liveness | Clamp on watchdog/3 approval heartbeat, not independent inactivity policy. |
+| `src/adapters/codex-appserver.ts:alive:inline:Math.min=30_000#0` | src/adapters/codex-appserver.ts:635:90 | operational | Excluded: derived liveness | Clamp on watchdog/3 approval heartbeat, not independent inactivity policy. |
+| `src/adapters/codex-appserver.ts:data:inline:launchId.length <= 128=128#0` | src/adapters/codex-appserver.ts:174:78 | safety floor | Excluded: Codex identity safety | data/launchId.length <= 128 bounds launch identity or approval tombstones; do not weaken replay/approval fences. |
+| `src/adapters/codex-appserver.ts:interceptActionApproval:inline:link.approvalIds.size >= 1024=1024#0` | src/adapters/codex-appserver.ts:621:34 | safety floor | Excluded: Codex identity safety | interceptActionApproval/link.approvalIds.size >= 1024 bounds launch identity or approval tombstones; do not weaken replay/approval fences. |
+| `src/adapters/codex-appserver.ts:readUsage:inline:setTimeout=30_000#0` | src/adapters/codex-appserver.ts:691:115, src/adapters/codex-appserver.ts:705:47 | operational | Excluded: pending-request cleanup | 30s expires a usage request bookkeeping entry; does not admit quota/context by guess. |
+| `src/adapters/codex-appserver.ts:spawnAppServer:inline:Bun.sleep=100#0` | src/adapters/codex-appserver.ts:448:23 | operational | Excluded: readiness arithmetic | 100ms poll combines with100-iteration health loop and stated10s readiness; do not tune cadence separately from deadline. |
+| `src/adapters/codex-appserver.ts:timer:inline:setTimeout=30_000#0` | src/adapters/codex-appserver.ts:691:115, src/adapters/codex-appserver.ts:705:47 | operational | Excluded: mutation ACK bound | 30s thread/revert acknowledgement bound preserves unknown/refusal and identity fence on missing reply. |
+| `src/adapters/codex-appserver.ts:timer:inline:this.opts.steerTimeoutMs ?? 10_000=10_000#0` | src/adapters/codex-appserver.ts:316:42, src/adapters/codex-appserver.ts:355:116 | operational | Excluded: existing host seam | Existing steerTimeoutMs already controls ACK wait; no second generic deadline in this H5 slice. |
+| `src/adapters/codex-review-isolation.ts:CAP:constant:CAP=128 * 1024#0` | src/adapters/codex-review-isolation.ts:16:7 | safety floor | Excluded: isolation safety | CAP/CAP bounds untrusted isolation input, credential-deny proof, private-path snapshot, feature inspection or verified process cleanup; do not loosen through operational settings. |
+| `src/adapters/codex-review-isolation.ts:MAX_SERVERS:constant:MAX_SERVERS=64#0` | src/adapters/codex-review-isolation.ts:16:25 | safety floor | Excluded: isolation safety | MAX_SERVERS/MAX_SERVERS bounds untrusted isolation input, credential-deny proof, private-path snapshot, feature inspection or verified process cleanup; do not loosen through operational settings. |
+| `src/adapters/codex-review-isolation.ts:codexCoreDenyGlobs:inline:names.length > 64=64#0` | src/adapters/codex-review-isolation.ts:20:22 | safety floor | Excluded: isolation safety | codexCoreDenyGlobs/names.length > 64 bounds untrusted isolation input, credential-deny proof, private-path snapshot, feature inspection or verified process cleanup; do not loosen through operational settings. |
+| `src/adapters/codex-review-isolation.ts:codexCoreDenyGlobs:inline:segment.length > 256=256#0` | src/adapters/codex-review-isolation.ts:43:57 | safety floor | Excluded: isolation safety | codexCoreDenyGlobs/segment.length > 256 bounds untrusted isolation input, credential-deny proof, private-path snapshot, feature inspection or verified process cleanup; do not loosen through operational settings. |
+| `src/adapters/codex-review-isolation.ts:codexCoreDenyGlobs:inline:segments.length > 64=64#0` | src/adapters/codex-review-isolation.ts:20:46 | safety floor | Excluded: isolation safety | codexCoreDenyGlobs/segments.length > 64 bounds untrusted isolation input, credential-deny proof, private-path snapshot, feature inspection or verified process cleanup; do not loosen through operational settings. |
+| `src/adapters/codex-review-isolation.ts:codexCoreDenyGlobs:inline:source.length > 256=256#0` | src/adapters/codex-review-isolation.ts:23:55 | safety floor | Excluded: isolation safety | codexCoreDenyGlobs/source.length > 256 bounds untrusted isolation input, credential-deny proof, private-path snapshot, feature inspection or verified process cleanup; do not loosen through operational settings. |
+| `src/adapters/codex-review-isolation.ts:deadline:inline:deadline=12_000#0` | src/adapters/codex-review-isolation.ts:190:42 | operational | Excluded: isolation proof budget | Whole12s preparation budget and1..2000ms remaining-budget clamps bound sandbox/MCP proof; no partial success after expiry. |
+| `src/adapters/codex-review-isolation.ts:hostCredentialRoots:inline:configured.length > 64=64#0` | src/adapters/codex-review-isolation.ts:84:27 | safety floor | Excluded: isolation safety | hostCredentialRoots/configured.length > 64 bounds untrusted isolation input, credential-deny proof, private-path snapshot, feature inspection or verified process cleanup; do not loosen through operational settings. |
+| `src/adapters/codex-review-isolation.ts:killMs:inline:killMs=500#0` | src/adapters/codex-review-isolation.ts:205:81 | safety floor | Excluded: isolation safety | killMs/killMs bounds untrusted isolation input, credential-deny proof, private-path snapshot, feature inspection or verified process cleanup; do not loosen through operational settings. |
+| `src/adapters/codex-review-isolation.ts:prepare:inline:ctx.privatePaths.length > 128=128#0` | src/adapters/codex-review-isolation.ts:221:77 | safety floor | Excluded: isolation safety | prepare/ctx.privatePaths.length > 128 bounds untrusted isolation input, credential-deny proof, private-path snapshot, feature inspection or verified process cleanup; do not loosen through operational settings. |
+| `src/adapters/codex-review-isolation.ts:proveDisabledFeatures:inline:rows.length > 512=512#0` | src/adapters/codex-review-isolation.ts:162:21 | safety floor | Excluded: isolation safety | proveDisabledFeatures/rows.length > 512 bounds untrusted isolation input, credential-deny proof, private-path snapshot, feature inspection or verified process cleanup; do not loosen through operational settings. |
+| `src/adapters/codex-review-isolation.ts:termMs:inline:termMs=100#0` | src/adapters/codex-review-isolation.ts:205:68 | safety floor | Excluded: isolation safety | termMs/termMs bounds untrusted isolation input, credential-deny proof, private-path snapshot, feature inspection or verified process cleanup; do not loosen through operational settings. |
+| `src/adapters/codex-review-isolation.ts:timer:inline:Math.max=1#0` | src/adapters/codex-review-isolation.ts:201:102 | operational | Excluded: isolation proof budget | Whole12s preparation budget and1..2000ms remaining-budget clamps bound sandbox/MCP proof; no partial success after expiry. |
+| `src/adapters/codex-review-isolation.ts:timer:inline:Math.min=2000#0` | src/adapters/codex-review-isolation.ts:201:114 | operational | Excluded: isolation proof budget | Whole12s preparation budget and1..2000ms remaining-budget clamps bound sandbox/MCP proof; no partial success after expiry. |
+| `src/adapters/compat.ts:MAX_BYTES:constant:MAX_BYTES=64 * 1024#0` | src/adapters/compat.ts:104:7 | safety floor | Excluded: compatibility safety | MAX_BYTES/MAX_BYTES bounds compatibility document/trust input or scalar text before native execution. |
+| `src/adapters/compat.ts:MAX_TRUST:constant:MAX_TRUST=64#0` | src/adapters/compat.ts:101:7 | safety floor | Excluded: compatibility safety | MAX_TRUST/MAX_TRUST bounds compatibility document/trust input or scalar text before native execution. |
+| `src/adapters/compat.ts:plain:inline:text.length <= 64=64#0` | src/adapters/compat.ts:28:48 | safety floor | Excluded: compatibility safety | plain/text.length <= 64 bounds compatibility document/trust input or scalar text before native execution. |
+| `src/adapters/configured-acp.ts:configuredAcpDefinitions:inline:Object.keys(declarations).length > 64=64#0` | src/adapters/configured-acp.ts:53:42 | safety floor | Excluded: declaration safety | configuredAcpDefinitions/Object.keys(declarations).length > 64 bounds executable adapter declaration count/text; existing machine-local provenance must remain unchanged. |
+| `src/adapters/configured-acp.ts:text:inline:max=4096#0` | src/adapters/configured-acp.ts:29:47 | safety floor | Excluded: declaration safety | text/max bounds executable adapter declaration count/text; existing machine-local provenance must remain unchanged. |
+| `src/adapters/conformance/acp.ts:permissionModeTimeoutMs:inline:permissionModeTimeoutMs=40#0` | src/adapters/conformance/acp.ts:61:36 | test seam | Excluded: existing seam | permissionModeTimeoutMs/permissionModeTimeoutMs is already an injected fixture/host deadline; preserve its existing parameter and fallback rather than add a second config authority. |
+| `src/adapters/conformance/kit.ts:deadline:inline:deadline=5000#0` | src/adapters/conformance/kit.ts:7:33 | test seam | Excluded: existing seam | deadline/deadline is already an injected fixture/host deadline; preserve its existing parameter and fallback rather than add a second config authority. |
+| `src/adapters/conformance/kit.ts:until:inline:Bun.sleep=10#0` | src/adapters/conformance/kit.ts:8:65 | test seam | Excluded: existing seam | until/Bun.sleep is already an injected fixture/host deadline; preserve its existing parameter and fallback rather than add a second config authority. |
+| `src/adapters/conformance/local-pi.ts:<anonymous>:inline:expect((await event({ type: agent_start, generation: 3, sessionId: saved-session })).status).toBe=200#0` | src/adapters/conformance/local-pi.ts:90:109 | contract | Excluded: wire/schema contract | <anonymous>/expect((await event({ type: agent_start, generation: 3, sessionId: saved-session })).status).toBe defines protocol version, close code, positional arguments, role cardinality, peer tool identity or fixture response assertion; callers must continue interpreting the same value. |
+| `src/adapters/definitions/native-cli-entry-jcode.ts:timer:inline:setTimeout=200#0` | src/adapters/definitions/native-cli-entry-jcode.ts:32:40 | operational | Excluded: fixed startup budget | Ruling3384d552 leaves owned-daemon readiness at30s; fixed65s CLI start and default30s callers do not admit a raised startup deadline. Preserve ownership and failed-start cleanup. |
+| `src/adapters/definitions/native-cli-jcode-mcp.ts:document:inline:stat.size > 256 * 1024=256 * 1024#0` | src/adapters/definitions/native-cli-jcode-mcp.ts:13:82 | safety floor | Excluded: MCP input safety | document/stat.size > 256 * 1024 bounds the on-disk MCP document at stat/read/open validation stages; no partial oversized configuration is trusted. |
+| `src/adapters/definitions/native-cli-jcode-mcp.ts:readBoundedJson:inline:info.size > 256 * 1024=256 * 1024#0` | src/adapters/definitions/native-cli-jcode-mcp.ts:89:82 | safety floor | Excluded: MCP input safety | readBoundedJson/info.size > 256 * 1024 bounds the on-disk MCP document at stat/read/open validation stages; no partial oversized configuration is trusted. |
+| `src/adapters/definitions/native-cli-jcode-mcp.ts:readBoundedJson:inline:open.size > 256 * 1024=256 * 1024#0` | src/adapters/definitions/native-cli-jcode-mcp.ts:95:59 | safety floor | Excluded: MCP input safety | readBoundedJson/open.size > 256 * 1024 bounds the on-disk MCP document at stat/read/open validation stages; no partial oversized configuration is trusted. |
+| `src/adapters/definitions/native-cli-jcode-mcp.ts:timeout:inline:timeout=3000#0` | src/adapters/definitions/native-cli-jcode-mcp.ts:55:119 | operational | Excluded: MCP provenance proof | 3s bounds Git metadata read that verifies MCP configuration provenance; unknown remains refused. |
+| `src/adapters/definitions/native-cli-preview-claude.ts:previewClaude:inline:launch.args.slice=2#0` | src/adapters/definitions/native-cli-preview-claude.ts:29:58 | contract | Excluded: wire/schema contract | previewClaude/launch.args.slice defines protocol version, close code, positional arguments, role cardinality, peer tool identity or fixture response assertion; callers must continue interpreting the same value. |
+| `src/adapters/definitions/native-config-defaults.ts:max_steps:inline:max_steps=30#0` | src/adapters/definitions/native-config-defaults.ts:11:143, src/adapters/definitions/native-config-defaults.ts:12:112 | contract | Excluded: existing native config | max_steps is a native config default or validator limit (Pi/local max_steps or efficient_wait_ms); use that existing schema, not adapter_timing. |
+| `src/adapters/definitions/native-config-defaults.ts:max_steps:inline:max_steps=30#1` | src/adapters/definitions/native-config-defaults.ts:11:143, src/adapters/definitions/native-config-defaults.ts:12:112 | contract | Excluded: existing native config | max_steps is a native config default or validator limit (Pi/local max_steps or efficient_wait_ms); use that existing schema, not adapter_timing. |
+| `src/adapters/definitions/native-config-policy.ts:efficient_wait_ms:inline:v.number=0#0` | src/adapters/definitions/native-config-policy.ts:12:126 | contract | Excluded: existing native config | v.number is a native config default or validator limit (Pi/local max_steps or efficient_wait_ms); use that existing schema, not adapter_timing. |
+| `src/adapters/definitions/native-config-policy.ts:efficient_wait_ms:inline:v.number=119999#0` | src/adapters/definitions/native-config-policy.ts:12:129 | contract | Excluded: existing native config | v.number is a native config default or validator limit (Pi/local max_steps or efficient_wait_ms); use that existing schema, not adapter_timing. |
+| `src/adapters/definitions/native-config-policy.ts:max_steps:inline:v.number=1#0` | src/adapters/definitions/native-config-policy.ts:6:176, src/adapters/definitions/native-config-policy.ts:9:171 | contract | Excluded: existing native config | v.number is a native config default or validator limit (Pi/local max_steps or efficient_wait_ms); use that existing schema, not adapter_timing. |
+| `src/adapters/definitions/native-config-policy.ts:max_steps:inline:v.number=1#1` | src/adapters/definitions/native-config-policy.ts:6:176, src/adapters/definitions/native-config-policy.ts:9:171 | contract | Excluded: existing native config | v.number is a native config default or validator limit (Pi/local max_steps or efficient_wait_ms); use that existing schema, not adapter_timing. |
+| `src/adapters/definitions/native-config-policy.ts:max_steps:inline:v.number=1_000_000#0` | src/adapters/definitions/native-config-policy.ts:6:179, src/adapters/definitions/native-config-policy.ts:9:174 | contract | Excluded: existing native config | v.number is a native config default or validator limit (Pi/local max_steps or efficient_wait_ms); use that existing schema, not adapter_timing. |
+| `src/adapters/definitions/native-config-policy.ts:max_steps:inline:v.number=1_000_000#1` | src/adapters/definitions/native-config-policy.ts:6:179, src/adapters/definitions/native-config-policy.ts:9:174 | contract | Excluded: existing native config | v.number is a native config default or validator limit (Pi/local max_steps or efficient_wait_ms); use that existing schema, not adapter_timing. |
+| `src/adapters/definitions/native-policy-aux.ts:absoluteContinuityPath:inline:value.length <= 4096=4096#0` | src/adapters/definitions/native-policy-aux.ts:127:75 | safety floor | Excluded: native policy safety | absoluteContinuityPath/value.length <= 4096 bounds continuity path or plugin inventory bytes used for native policy/proof. |
+| `src/adapters/definitions/native-policy-aux.ts:text:inline:st.size > 1024 * 1024=1024 * 1024#0` | src/adapters/definitions/native-policy-aux.ts:65:35 | safety floor | Excluded: native policy safety | text/st.size > 1024 * 1024 bounds continuity path or plugin inventory bytes used for native policy/proof. |
+| `src/adapters/external-metadata.ts:MAX_MODULES:constant:MAX_MODULES=16#0` | src/adapters/external-metadata.ts:5:7 | safety floor | Excluded: external module safety | MAX_MODULES/MAX_MODULES bounds module inventory, bytes, parser nesting, import execution, path text or metadata snapshots from untrusted external adapters. |
+| `src/adapters/external-module-scan.ts:code:inline:depth > 128=128#0` | src/adapters/external-module-scan.ts:54:17, src/adapters/external-module-scan.ts:71:17 | safety floor | Excluded: external module safety | code/depth > 128 bounds module inventory, bytes, parser nesting, import execution, path text or metadata snapshots from untrusted external adapters. |
+| `src/adapters/external-module-scan.ts:template:inline:depth > 128=128#0` | src/adapters/external-module-scan.ts:54:17, src/adapters/external-module-scan.ts:71:17 | safety floor | Excluded: external module safety | template/depth > 128 bounds module inventory, bytes, parser nesting, import execution, path text or metadata snapshots from untrusted external adapters. |
+| `src/adapters/external-modules.ts:MAX_MODULES:constant:MAX_MODULES=16#0` | src/adapters/external-modules.ts:16:7 | safety floor | Excluded: external module safety | MAX_MODULES/MAX_MODULES bounds module inventory, bytes, parser nesting, import execution, path text or metadata snapshots from untrusted external adapters. |
+| `src/adapters/external-modules.ts:MAX_MODULE_BYTES:constant:MAX_MODULE_BYTES=2 * 1024 * 1024#0` | src/adapters/external-modules.ts:16:25 | safety floor | Excluded: external module safety | MAX_MODULE_BYTES/MAX_MODULE_BYTES bounds module inventory, bytes, parser nesting, import execution, path text or metadata snapshots from untrusted external adapters. |
+| `src/adapters/external-modules.ts:MODULE_IMPORT_TIMEOUT_MS:constant:MODULE_IMPORT_TIMEOUT_MS=2000#0` | src/adapters/external-modules.ts:196:7 | safety floor | Excluded: external module safety | MODULE_IMPORT_TIMEOUT_MS/MODULE_IMPORT_TIMEOUT_MS bounds module inventory, bytes, parser nesting, import execution, path text or metadata snapshots from untrusted external adapters. |
+| `src/adapters/external-modules.ts:path:inline:text=4096#0` | src/adapters/external-modules.ts:26:33 | safety floor | Excluded: external module safety | path/text bounds module inventory, bytes, parser nesting, import execution, path text or metadata snapshots from untrusted external adapters. |
+| `src/adapters/external-modules.ts:snapshot:inline:depth > 12=12#0` | src/adapters/external-modules.ts:106:15 | safety floor | Excluded: external module safety | snapshot/depth > 12 bounds module inventory, bytes, parser nesting, import execution, path text or metadata snapshots from untrusted external adapters. |
+| `src/adapters/jcode.ts:<anonymous>:inline:buffer.length > 1024 * 1024=1024 * 1024#0` | src/adapters/jcode.ts:109:27 | safety floor | Excluded: Jcode input safety | <anonymous>/buffer.length > 1024 * 1024 bounds native reply buffering or saved-session bytes before identity/adoption proof. |
+| `src/adapters/jcode.ts:<anonymous>:inline:setTimeout=3000#0` | src/adapters/jcode.ts:259:174 | operational | Excluded: failed-start cleanup | 3s waits for the owned failed-start child to exit; it is cleanup proof, not successful startup admission. |
+| `src/adapters/jcode.ts:STEER_TIMEOUT_MS:constant:STEER_TIMEOUT_MS=5000#0` | src/adapters/jcode.ts:80:7 | operational | Converted: jcode_steer_timeout_s | Existing steerTimeoutMs host option, captured once by nativeSteer; ONE timer spans ping/subscribe/state/sent, with uncertain outcome after send. |
+| `src/adapters/jcode.ts:jcodeVersionAsync:inline:timeoutMs=10_000#0` | src/adapters/jcode.ts:160:79 | test seam | Excluded: existing seam | jcodeVersionAsync/timeoutMs is already an injected fixture/host deadline; preserve its existing parameter and fallback rather than add a second config authority. |
+| `src/adapters/jcode.ts:savedSession:inline:before.size > 32 * 1024 * 1024=32 * 1024 * 1024#0` | src/adapters/jcode.ts:53:65 | safety floor | Excluded: Jcode input safety | savedSession/before.size > 32 * 1024 * 1024 bounds native reply buffering or saved-session bytes before identity/adoption proof. |
+| `src/adapters/jcode.ts:timeout:inline:timeout=10_000#0` | src/adapters/jcode.ts:140:169 | operational | Excluded: version proof bound | Synchronous native version/capability preflight has bounded10s execution/output; not model startup readiness. |
+| `src/adapters/jcode.ts:timer:inline:setTimeout=30_000#0` | src/adapters/jcode.ts:222:114 | operational | Excluded: fixed startup budget | Ruling3384d552 leaves owned-daemon readiness at30s; fixed65s CLI start and default30s callers do not admit a raised startup deadline. Preserve ownership and failed-start cleanup. |
+| `src/adapters/kimi-review.ts:<anonymous>:inline:text.length > 4096=4096#0` | src/adapters/kimi-review.ts:94:94 | safety floor | Excluded: reviewer input safety | <anonymous>/text.length > 4096 bounds inspection bytes, scalar object cardinality or nesting before native reviewer proof. |
+| `src/adapters/kimi-review.ts:read:inline:limit=262_144#0` | src/adapters/kimi-review.ts:32:37 | safety floor | Excluded: reviewer input safety | read/limit bounds inspection bytes, scalar object cardinality or nesting before native reviewer proof. |
+| `src/adapters/kimi-review.ts:scalar:inline:Object.keys(value).length <= 32=32#0` | src/adapters/kimi-review.ts:40:53 | safety floor | Excluded: reviewer input safety | scalar/Object.keys(value).length <= 32 bounds inspection bytes, scalar object cardinality or nesting before native reviewer proof. |
+| `src/adapters/kimi-review.ts:scalar:inline:depth > 4=4#0` | src/adapters/kimi-review.ts:37:15 | safety floor | Excluded: reviewer input safety | scalar/depth > 4 bounds inspection bytes, scalar object cardinality or nesting before native reviewer proof. |
+| `src/adapters/kimi-review.ts:stopKimiReview:inline:Bun.sleep=50#0` | src/adapters/kimi-review.ts:105:114 | operational | Excluded: OAuth-lock cleanup cadence | 50ms observes native lock disappearance during existing grace; never bypass or widen token-lock policy. |
+| `src/adapters/kimi-review.ts:stopKimiReview:inline:graceMs=10_000#0` | src/adapters/kimi-review.ts:100:95 | test seam | Excluded: existing seam | stopKimiReview/graceMs is already an injected fixture/host deadline; preserve its existing parameter and fallback rather than add a second config authority. |
+| `src/adapters/kimi-review.ts:timer:inline:setTimeout=5_000#0` | src/adapters/kimi-review.ts:91:37 | operational | Excluded: native reviewer proof | Bounded version/print proof uses isolated child/environment and awaits cleanup; not ordinary conversation timeout. |
+| `src/adapters/kimi-wire-usage.ts:DEFAULT_CHUNK:constant:DEFAULT_CHUNK=1024 * 1024#0` | src/adapters/kimi-wire-usage.ts:71:7 | operational | Excluded: existing read-budget seam | DEFAULT_CHUNK already overridden by options.maxBytes with a LINE_CAP*2 floor; preserve cursor/parser contract instead of new timer settings. |
+| `src/adapters/kimi-wire-usage.ts:INDEX_CAP:constant:INDEX_CAP=16 * 1024 * 1024#0` | src/adapters/kimi-wire-usage.ts:70:7 | safety floor | Excluded: usage parser safety | INDEX_CAP/INDEX_CAP bounds index/line/agent input or oversized-line usage-marker sniffing; oversized ambiguous usage must remain unknown. |
+| `src/adapters/kimi-wire-usage.ts:LINE_CAP:constant:LINE_CAP=64 * 1024#0` | src/adapters/kimi-wire-usage.ts:69:7 | safety floor | Excluded: usage parser safety | LINE_CAP/LINE_CAP bounds index/line/agent input or oversized-line usage-marker sniffing; oversized ambiguous usage must remain unknown. |
+| `src/adapters/kimi-wire-usage.ts:MAX_AGENTS:constant:MAX_AGENTS=256#0` | src/adapters/kimi-wire-usage.ts:67:7 | safety floor | Excluded: usage parser safety | MAX_AGENTS/MAX_AGENTS bounds index/line/agent input or oversized-line usage-marker sniffing; oversized ambiguous usage must remain unknown. |
+| `src/adapters/kimi-wire-usage.ts:PRINT_HEAD:constant:PRINT_HEAD=64#0` | src/adapters/kimi-wire-usage.ts:78:7 | contract | Excluded: storage identity contract | PRINT_HEAD/PRINT_HEAD fixes cursor fingerprint or usage-id encoding, so changing it would change persisted source identity. |
+| `src/adapters/kimi-wire-usage.ts:PRINT_TAIL:constant:PRINT_TAIL=256#0` | src/adapters/kimi-wire-usage.ts:78:24 | contract | Excluded: storage identity contract | PRINT_TAIL/PRINT_TAIL fixes cursor fingerprint or usage-id encoding, so changing it would change persisted source identity. |
+| `src/adapters/kimi-wire-usage.ts:id:inline:createHash(sha256).update(this.sessionId).update(\0).update(agent).update(\0).update(String(offset)).digest(hex).slice=32#0` | src/adapters/kimi-wire-usage.ts:300:146 | contract | Excluded: storage identity contract | id/createHash(sha256).update(this.sessionId).update(\0).update(agent).update(\0).update(String(offset)).digest(hex).slice fixes cursor fingerprint or usage-id encoding, so changing it would change persisted source identity. |
+| `src/adapters/kimi-wire-usage.ts:readFile:inline:buffer.subarray=256#0` | src/adapters/kimi-wire-usage.ts:267:42 | safety floor | Excluded: usage parser safety | readFile/buffer.subarray bounds index/line/agent input or oversized-line usage-marker sniffing; oversized ambiguous usage must remain unknown. |
+| `src/adapters/local-worker.ts:HISTORY_CHARS:constant:HISTORY_CHARS=100000#0` | src/adapters/local-worker.ts:56:7 | operational | Excluded: model/context group | Conversation context retention/elision policy preserves complete assistant/tool pairs; not native handshake policy. |
+| `src/adapters/local-worker.ts:TURN_CHARS:constant:TURN_CHARS=120000#0` | src/adapters/local-worker.ts:58:7 | operational | Excluded: model/context group | Conversation context retention/elision policy preserves complete assistant/tool pairs; not native handshake policy. |
+| `src/adapters/local-worker.ts:alive:inline:setInterval=30_000#0` | src/adapters/local-worker.ts:267:104 | operational | Excluded: tool liveness heartbeat | 30s marks a still-running managed tool active; changing independent of watchdog can falsely cancel valid work. |
+| `src/adapters/local-worker.ts:elide:inline:(m.content?.length ?? 0) > 200=200#0` | src/adapters/local-worker.ts:482:59 | operational | Excluded: model/context group | Conversation context retention/elision policy preserves complete assistant/tool pairs; not native handshake policy. |
+| `src/adapters/local-worker.ts:max_tokens:inline:maxTokens ?? 2048=2048#0` | src/adapters/local-worker.ts:113:137 | operational | Excluded: existing model seam | maxTokens already comes from host/model routing; no adapter-wide competing output budget. |
+| `src/adapters/local-worker.ts:note:inline:e.message.slice=200#0` | src/adapters/local-worker.ts:204:119 | safety floor | Excluded: error text safety | Error-note text is capped before transport/logging; not native timeout policy. |
+| `src/adapters/pi.ts:<anonymous>:inline:Bun.sleep=50#0` | src/adapters/pi.ts:539:70, src/adapters/pi.ts:550:64, src/adapters/pi.ts:584:62, src/adapters/pi.ts:588:62 | operational | Excluded: verified cleanup cadence | <anonymous>/Bun.sleep bounds positive TERM/KILL disappearance observation or cleanup polling, not successful session admission. |
+| `src/adapters/pi.ts:<anonymous>:inline:this.opts.stopGraceMs ?? 5_000=5_000#0` | src/adapters/pi.ts:490:234, src/adapters/pi.ts:524:229, src/adapters/pi.ts:533:46 | test seam | Excluded: existing seam | <anonymous>/this.opts.stopGraceMs ?? 5_000 is already an injected fixture/host deadline; preserve its existing parameter and fallback rather than add a second config authority. |
+| `src/adapters/pi.ts:<anonymous>:inline:this.opts.stopGraceMs ?? 5_000=5_000#1` | src/adapters/pi.ts:490:234, src/adapters/pi.ts:524:229, src/adapters/pi.ts:533:46 | test seam | Excluded: existing seam | <anonymous>/this.opts.stopGraceMs ?? 5_000 is already an injected fixture/host deadline; preserve its existing parameter and fallback rather than add a second config authority. |
+| `src/adapters/pi.ts:TERMINAL_OWNER_MAX_AGE_MS:constant:TERMINAL_OWNER_MAX_AGE_MS=1000#0` | src/adapters/pi.ts:62:7 | operational | Excluded: terminal identity freshness | 1s owner proof freshness and500ms monitoring are coupled authority/revocation limits, not launch latency settings. |
+| `src/adapters/pi.ts:deadline:inline:deadline=2_000#0` | src/adapters/pi.ts:583:33 | operational | Excluded: verified cleanup cadence | deadline/deadline bounds positive TERM/KILL disappearance observation or cleanup polling, not successful session admission. |
+| `src/adapters/pi.ts:expiresAt:inline:expiresAt=30_000#0` | src/adapters/pi.ts:330:105 | operational | Excluded: one-use authority expiry | 30s expires idle-bash reservation authority; never turn an old reservation into durable permission. |
+| `src/adapters/pi.ts:grace:inline:this.opts.stopGraceMs ?? 5_000=5_000#0` | src/adapters/pi.ts:490:234, src/adapters/pi.ts:524:229, src/adapters/pi.ts:533:46 | test seam | Excluded: existing seam | grace/this.opts.stopGraceMs ?? 5_000 is already an injected fixture/host deadline; preserve its existing parameter and fallback rather than add a second config authority. |
+| `src/adapters/pi.ts:handleBridgeEvent:inline:event.id.length <= 100=100#0` | src/adapters/pi.ts:780:112 | safety floor | Excluded: Pi input/lifecycle safety | handleBridgeEvent/event.id.length <= 100 bounds bridge request bytes, event identifiers, aborted tool ids or usage dedupe; preserve stale/duplicate fences. |
+| `src/adapters/pi.ts:handleBridgeEvent:inline:event.toolCallId.length <= 512=512#0` | src/adapters/pi.ts:752:108 | contract | Excluded: wire/schema contract | handleBridgeEvent/event.toolCallId.length <= 512 defines protocol version, close code, positional arguments, role cardinality, peer tool identity or fixture response assertion; callers must continue interpreting the same value. |
+| `src/adapters/pi.ts:handleBridgeEvent:inline:this.abortedToolIds.size >= 64=64#0` | src/adapters/pi.ts:758:41 | safety floor | Excluded: Pi input/lifecycle safety | handleBridgeEvent/this.abortedToolIds.size >= 64 bounds bridge request bytes, event identifiers, aborted tool ids or usage dedupe; preserve stale/duplicate fences. |
+| `src/adapters/pi.ts:handleBridgeEvent:inline:this.usageSeen.size > 1000=1000#0` | src/adapters/pi.ts:782:33 | safety floor | Excluded: Pi input/lifecycle safety | handleBridgeEvent/this.usageSeen.size > 1000 bounds bridge request bytes, event identifiers, aborted tool ids or usage dedupe; preserve stale/duplicate fences. |
+| `src/adapters/pi.ts:handleToolRequest:inline:setTimeout=10#0` | src/adapters/pi.ts:303:12 | operational | Excluded: event-ordering yield | 10ms lets expiration reply finish before sibling abort/native turn end; not a tool timeout knob. |
+| `src/adapters/pi.ts:idleTimeout:inline:idleTimeout=60#0` | src/adapters/pi.ts:367:77 | operational | Excluded: bridge transport contract | 60s is HTTP bridge idle socket behavior; not native owner freshness or conversation inactivity. |
+| `src/adapters/pi.ts:maxRequestBodySize:inline:maxRequestBodySize=2_000_000#0` | src/adapters/pi.ts:367:101 | safety floor | Excluded: Pi input/lifecycle safety | maxRequestBodySize/maxRequestBodySize bounds bridge request bytes, event identifiers, aborted tool ids or usage dedupe; preserve stale/duplicate fences. |
+| `src/adapters/pi.ts:snapshot:inline:this.waitRpc=15_000#0` | src/adapters/pi.ts:182:42, src/adapters/pi.ts:417:51 | operational | Excluded: native snapshot ACK proof | 15s native get_state wait proves session/idle state; timeout must stay unknown rather than empty or fresh. |
+| `src/adapters/pi.ts:startOwnerMonitor:inline:setInterval=500#0` | src/adapters/pi.ts:895:62 | operational | Excluded: terminal identity freshness | 1s owner proof freshness and500ms monitoring are coupled authority/revocation limits, not launch latency settings. |
+| `src/adapters/pi.ts:state:inline:this.waitRpc=15_000#0` | src/adapters/pi.ts:182:42, src/adapters/pi.ts:417:51 | operational | Excluded: native snapshot ACK proof | 15s native get_state wait proves session/idle state; timeout must stay unknown rather than empty or fresh. |
+| `src/adapters/pi.ts:stop:inline:Bun.sleep=50#0` | src/adapters/pi.ts:539:70, src/adapters/pi.ts:550:64, src/adapters/pi.ts:584:62, src/adapters/pi.ts:588:62 | operational | Excluded: verified cleanup cadence | stop/Bun.sleep bounds positive TERM/KILL disappearance observation or cleanup polling, not successful session admission. |
+| `src/adapters/pi.ts:stopSurvivingOwner:inline:Bun.sleep=50#0` | src/adapters/pi.ts:539:70, src/adapters/pi.ts:550:64, src/adapters/pi.ts:584:62, src/adapters/pi.ts:588:62 | operational | Excluded: verified cleanup cadence | stopSurvivingOwner/Bun.sleep bounds positive TERM/KILL disappearance observation or cleanup polling, not successful session admission. |
+| `src/adapters/pi.ts:stopSurvivingOwner:inline:Bun.sleep=50#1` | src/adapters/pi.ts:539:70, src/adapters/pi.ts:550:64, src/adapters/pi.ts:584:62, src/adapters/pi.ts:588:62 | operational | Excluded: verified cleanup cadence | stopSurvivingOwner/Bun.sleep bounds positive TERM/KILL disappearance observation or cleanup polling, not successful session admission. |
+| `src/adapters/pi.ts:timer:inline:setTimeout=30_000#0` | src/adapters/pi.ts:845:10, src/adapters/pi.ts:853:377 | operational | Excluded: native command ACK bound | 30s bounds sendTui/sendRpc acknowledgement; retain uncertain receipt and current-session fences. |
+| `src/adapters/pi.ts:timer:inline:setTimeout=30_000#1` | src/adapters/pi.ts:845:10, src/adapters/pi.ts:853:377 | operational | Excluded: native command ACK bound | 30s bounds sendTui/sendRpc acknowledgement; retain uncertain receipt and current-session fences. |
+| `src/adapters/registry.ts:roleValues:inline:roles.length <= 4=4#0` | src/adapters/registry.ts:123:87 | contract | Excluded: wire/schema contract | roleValues/roles.length <= 4 defines protocol version, close code, positional arguments, role cardinality, peer tool identity or fixture response assertion; callers must continue interpreting the same value. |
+| `src/adapters/reviewer-mcp.ts:BODY_CAP:constant:BODY_CAP=256 * 1024#0` | src/adapters/reviewer-mcp.ts:15:7 | safety floor | Excluded: reviewer transport safety | BODY_CAP/BODY_CAP caps MCP request/result/error text; not an operational latency. |
+| `src/adapters/reviewer-mcp.ts:RESULT_CAP:constant:RESULT_CAP=4 * 1024 * 1024#0` | src/adapters/reviewer-mcp.ts:15:30 | safety floor | Excluded: reviewer transport safety | RESULT_CAP/RESULT_CAP caps MCP request/result/error text; not an operational latency. |
+| `src/adapters/reviewer-mcp.ts:message:inline:sanitize(failure.message).slice=4000#0` | src/adapters/reviewer-mcp.ts:77:87 | safety floor | Excluded: reviewer transport safety | message/sanitize(failure.message).slice caps MCP request/result/error text; not an operational latency. |
+| `src/adapters/reviewer-print.ts:onSpawn:inline:setInterval=100#0` | src/adapters/reviewer-print.ts:343:93 | operational | Excluded: review-token revocation | 100ms checks current task/head/revision authorization while child runs; widening permits stale review work. |
+| `src/hub/action-enforce.ts:<anonymous>:inline:limits[key] > 1=1#0` | src/hub/action-enforce.ts:87:67 | safety floor | Excluded: authority safety | The single admitted action limit is an authorization ceiling, not a tuning parameter. |
+| `src/hub/child-process.ts:check:inline:setTimeout=1_000#0` | src/hub/child-process.ts:203:89 | operational | Excluded: shared cleanup proof | check/setTimeout bounds same-owner process-table reads, retries, disappearance polling or post-exit group checks; no tuning without cleanup proof contract review. |
+| `src/hub/child-process.ts:processTable:inline:attempt < 2=2#0` | src/hub/child-process.ts:71:35, src/hub/child-process.ts:85:35 | operational | Excluded: shared cleanup proof | processTable/attempt < 2 bounds same-owner process-table reads, retries, disappearance polling or post-exit group checks; no tuning without cleanup proof contract review. |
+| `src/hub/child-process.ts:readProcessTable:inline:attempt < 2=2#0` | src/hub/child-process.ts:71:35, src/hub/child-process.ts:85:35 | operational | Excluded: shared cleanup proof | readProcessTable/attempt < 2 bounds same-owner process-table reads, retries, disappearance polling or post-exit group checks; no tuning without cleanup proof contract review. |
+| `src/hub/child-process.ts:stopGroup:inline:Bun.sleep=100#0` | src/hub/child-process.ts:136:61, src/hub/child-process.ts:278:35, src/hub/child-process.ts:278:78 | operational | Excluded: shared cleanup proof | stopGroup/Bun.sleep bounds same-owner process-table reads, retries, disappearance polling or post-exit group checks; no tuning without cleanup proof contract review. |
+| `src/hub/child-process.ts:stopGroup:inline:Bun.sleep=100#1` | src/hub/child-process.ts:136:61, src/hub/child-process.ts:278:35, src/hub/child-process.ts:278:78 | operational | Excluded: shared cleanup proof | stopGroup/Bun.sleep bounds same-owner process-table reads, retries, disappearance polling or post-exit group checks; no tuning without cleanup proof contract review. |
+| `src/hub/child-process.ts:stopGroup:inline:Bun.sleep=50#0` | src/hub/child-process.ts:313:23 | operational | Excluded: shared cleanup proof | stopGroup/Bun.sleep bounds same-owner process-table reads, retries, disappearance polling or post-exit group checks; no tuning without cleanup proof contract review. |
+| `src/hub/child-process.ts:stopOwnedProcess:inline:Bun.sleep=100#0` | src/hub/child-process.ts:136:61, src/hub/child-process.ts:278:35, src/hub/child-process.ts:278:78 | operational | Excluded: shared cleanup proof | stopOwnedProcess/Bun.sleep bounds same-owner process-table reads, retries, disappearance polling or post-exit group checks; no tuning without cleanup proof contract review. |
+| `src/hub/child-process.ts:timeout:inline:timeout=10_000#0` | src/hub/child-process.ts:73:93 | operational | Excluded: shared cleanup proof | timeout/timeout bounds same-owner process-table reads, retries, disappearance polling or post-exit group checks; no tuning without cleanup proof contract review. |
+| `src/hub/child-process.ts:timer:inline:setTimeout=10_000#0` | src/hub/child-process.ts:88:57 | operational | Excluded: shared cleanup proof | timer/setTimeout bounds same-owner process-table reads, retries, disappearance polling or post-exit group checks; no tuning without cleanup proof contract review. |
+| `src/hub/instance-execution.ts:GIT_BUDGET_MS:constant:GIT_BUDGET_MS=5000#0` | src/hub/instance-execution.ts:14:7 | operational | Excluded: root validation proof budget | 5s is one total synchronous Git allowance over up to4 calls; exposed host seam already exists, and overflow must refuse workspace authority. |
+| `src/hub/instance-execution.ts:GIT_OUTPUT_BYTES:constant:GIT_OUTPUT_BYTES=1024 * 1024#0` | src/hub/instance-execution.ts:14:29 | safety floor | Excluded: root proof safety | Git output byte cap bounds synchronous workspace/root validation; preserve unknown/refusal on overflow. |
+| `src/hub/permission-payload.ts:title:inline:full.length > 600=600#0` | src/hub/permission-payload.ts:14:45 | safety floor | Excluded: permission preview safety | title/full.length > 600 bounds sanitized public permission preview, not permitted effects. |
+| `src/hub/permission-payload.ts:title:inline:full.slice=600#0` | src/hub/permission-payload.ts:14:65 | safety floor | Excluded: permission preview safety | title/full.slice bounds sanitized public permission preview, not permitted effects. |
+| `src/hub/start-mode.ts:PEER_START_RETRY_MS:constant:PEER_START_RETRY_MS=30000#0` | src/hub/start-mode.ts:8:14 | operational | Excluded: start authority/retry guard | 30s shared terminal-start guard and dashboard unconfirmed-response hold prevent duplicate native launch; changing it requires caller/launch proof coordination. |
+| `src/hub/terminal-open.ts:SETTLE_MS:constant:SETTLE_MS=1500#0` | src/hub/terminal-open.ts:16:7 | operational | Excluded: terminal readiness contract | 1.5s classifies still-running template as terminal success (documented shortcut); not native ready/session evidence and outside H5 adapter paths. |
+| `src/local/proxy.ts:onData:inline:head.length > 8192=8192#0` | src/local/proxy.ts:97:27 | safety floor | Excluded: proxy input safety | Header byte cap bounds sandbox network proxy parsing; do not expand bridge attack surface. |
+| `src/local/sandbox.ts:<anonymous>:inline:setTimeout=500#0` | src/local/sandbox.ts:213:94 | operational | Excluded: sandbox execution/cleanup seam | <anonymous>/setTimeout is existing timeoutMs command ceiling or500ms post-exit pipe-holder reap; preserve sandbox and owned-child cleanup, not handshake config. |
+| `src/local/sandbox.ts:OUTPUT_CAP:constant:OUTPUT_CAP=20000#0` | src/local/sandbox.ts:10:14 | safety floor | Excluded: sandbox safety | OUTPUT_CAP/OUTPUT_CAP bounds captured command output or sandbox path traversal depth; no execution authority changes. |
+| `src/local/sandbox.ts:timer:inline:opts.timeoutMs ?? 120_000=120_000#0` | src/local/sandbox.ts:199:55 | operational | Excluded: sandbox execution/cleanup seam | timer/opts.timeoutMs ?? 120_000 is existing timeoutMs command ceiling or500ms post-exit pipe-holder reap; preserve sandbox and owned-child cleanup, not handshake config. |
+| `src/local/sandbox.ts:walk:inline:depth > 8=8#0` | src/local/sandbox.ts:63:17 | safety floor | Excluded: sandbox safety | walk/depth > 8 bounds captured command output or sandbox path traversal depth; no execution authority changes. |
+| `src/local/tools.ts:maximum:inline:maximum=600#0` | src/local/tools.ts:105:258 | contract | Excluded: tool schema contract | maximum/maximum declares the public bash/read tool schema or seconds-to-milliseconds conversion; per-call inputs retain existing bounds. |
+| `src/local/tools.ts:minimum:inline:minimum=1#0` | src/local/tools.ts:102:127, src/local/tools.ts:102:167, src/local/tools.ts:105:246 | contract | Excluded: tool schema contract | minimum/minimum declares the public bash/read tool schema or seconds-to-milliseconds conversion; per-call inputs retain existing bounds. |
+| `src/local/tools.ts:minimum:inline:minimum=1#1` | src/local/tools.ts:102:127, src/local/tools.ts:102:167, src/local/tools.ts:105:246 | contract | Excluded: tool schema contract | minimum/minimum declares the public bash/read tool schema or seconds-to-milliseconds conversion; per-call inputs retain existing bounds. |
+| `src/local/tools.ts:minimum:inline:minimum=1#2` | src/local/tools.ts:102:127, src/local/tools.ts:102:167, src/local/tools.ts:105:246 | contract | Excluded: tool schema contract | minimum/minimum declares the public bash/read tool schema or seconds-to-milliseconds conversion; per-call inputs retain existing bounds. |
+| `src/local/tools.ts:out:inline:Number(a.limit) \|\| 2000=2000#0` | src/local/tools.ts:143:74 | safety floor | Excluded: local tool safety | out/Number(a.limit) || 2000 bounds read output, command text or file bytes; preserve existing sandbox/privacy policy. |
+| `src/local/tools.ts:runTool:inline:command.length > 4000=4000#0` | src/local/tools.ts:181:30 | safety floor | Excluded: local tool safety | runTool/command.length > 4000 bounds read output, command text or file bytes; preserve existing sandbox/privacy policy. |
+| `src/local/tools.ts:runTool:inline:statSync(file).size > 5_000_000=5_000_000#0` | src/local/tools.ts:140:35 | safety floor | Excluded: local tool safety | runTool/statSync(file).size > 5_000_000 bounds read output, command text or file bytes; preserve existing sandbox/privacy policy. |
+| `src/local/tools.ts:timeoutMs:inline:Number(a.timeout_s) \|\| 120=120#0` | src/local/tools.ts:184:189 | operational | Excluded: public per-call tool timeout | 120s is bash default under existing1..600s public schema; no new per-call override/control path. |
+| `src/local/tools.ts:timeoutMs:inline:timeoutMs=(Number(a.timeout_s) \|\| 120) * 1000#0` | src/local/tools.ts:184:165 | contract | Excluded: tool schema contract | timeoutMs/timeoutMs declares the public bash/read tool schema or seconds-to-milliseconds conversion; per-call inputs retain existing bounds. |
+| `src/pi/ceiling.ts:piToolStepCeiling:inline:e.sessionId.length > 200=200#0` | src/pi/ceiling.ts:51:79 | safety floor | Excluded: ceiling evidence safety | Session-id length bounds structured tool-ceiling evidence before it is associated with the native turn. |
+| `src/pi/extension.ts:<anonymous>:inline:setTimeout=250#0` | src/pi/extension.ts:124:66 | operational | Excluded: bridge settlement/retry contract | <anonymous>/setTimeout is250ms disconnected bridge retry or5s bounded prior-settlement wait; idle/session/generation guards remain mandatory after waiting. |
+| `src/pi/extension.ts:<anonymous>:inline:setTimeout=5_000#0` | src/pi/extension.ts:76:112 | operational | Excluded: bridge settlement/retry contract | <anonymous>/setTimeout is250ms disconnected bridge retry or5s bounded prior-settlement wait; idle/session/generation guards remain mandatory after waiting. |
+| `src/pi/extension.ts:contextWindow:inline:m.contextWindow ?? 131072=131072#0` | src/pi/extension.ts:135:178 | operational | Excluded: existing model declaration | Fallback model context/output declaration is overridden by host relay model metadata; not native context observation or handshake setting. |
+| `src/pi/extension.ts:maxSteps:inline:process.env.AGENTHUB_PI_MAX_STEPS ?? 30=30#0` | src/pi/extension.ts:29:62 | operational | Excluded: already configured | Existing Pi max_steps is passed by host launch; extension fallback must agree with that same native schema. |
+| `src/pi/extension.ts:maxTokens:inline:m.maxTokens ?? 8192=8192#0` | src/pi/extension.ts:135:212 | operational | Excluded: existing model declaration | Fallback model context/output declaration is overridden by host relay model metadata; not native context observation or handshake setting. |
+| `src/pi/launch.ts:AGENTHUB_PI_MAX_STEPS:inline:opts.maxSteps ?? 30=30#0` | src/pi/launch.ts:18:594 | operational | Excluded: already configured | opts.maxSteps is existing native Pi config; host passes it through the native environment, not a new H5 env setting. |
+| `src/pi/tool-receipts.ts:PI_TOOL_RESULT_CAP:constant:PI_TOOL_RESULT_CAP=100000#0` | src/pi/tool-receipts.ts:7:14 | contract | Excluded: receipt contract | PI_TOOL_RESULT_CAP/PI_TOOL_RESULT_CAP bounds persisted tool receipt payload/identity for replay; not a timing setting. |
+| `src/pi/tool-receipts.ts:execute:inline:callId.length > 512=512#0` | src/pi/tool-receipts.ts:40:72 | contract | Excluded: receipt contract | execute/callId.length > 512 bounds persisted tool receipt payload/identity for replay; not a timing setting. |
+| `src/pi/tool-receipts.ts:execute:inline:session.length > 512=512#0` | src/pi/tool-receipts.ts:40:49 | contract | Excluded: receipt contract | execute/session.length > 512 bounds persisted tool receipt payload/identity for replay; not a timing setting. |
+
+## Runtime boundaries
+
+- The daemon captures accepted values as primitive constructor options at the new peer start. Active peers keep their original values and deadlines.
+- Tool-ceiling, activity privacy/size and Jcode pre-send/post-send outcome fences retain their existing implementations. No session, permission, recovery, cleanup or quota capability is inferred from a timing value.
+- The excluded proof/identity/teardown bounds, wire/storage caps, existing configuration/test seams and benchmark-only values remain unchanged. The complete rows below preserve H0's classification separately from the code-read disposition.
+- Default and configured behavior tests are fixtures, not native/account timing evidence. Exact-head test and gate results are recorded in the PR; live editing and account-backed execution remain unverified.