@staix/agent-hub 0.22.0 → 0.23.1

package/docs/verification/2026-10-31-0.23.1.md

@@ -0,0 +1,74 @@
+# 0.23.1 release verification
+
+This record covers release preparation and source review. It claims no installation, no running-hub upgrade to 0.23.1 and no live TUI launch.
+
+## Candidate
+
+Version 0.23.1, prepared from main 95032a74 (2 commits since v0.23.0, 0 of them `feat`; bump rule: patch); main de0c4386 (#997, `test`) was merged into the release branch afterwards, and #1002 (`test`) reached main while the release PR #1003 was open; this second release PR covers it, so the release covers 4 commits, still patch. The release commits carry the version, the CHANGELOG section, the bundle and the documentation stamps.
+
+## Reviews
+
+Pull requests named by the commits since v0.23.0: #998, #996 (release-prepare); #997 (merged into the release branch from main); #1002 (on main before the #1003 merge commit).
+
+All four merged with exact-head CI green and no unresolved review thread. The claude[bot] review on each is the "extra usage unavailable" notice, not a review.
+
+- #996 (task 577): codex approved 6ba5f1ef in `hub.db`, the merged head; the codex connector reported no findings at that head.
+- #998 has no hub task: the person asked for the pin bump directly in a Claude session. It was reviewed by OCR delegation (Kimi Code, read-only, 12/12 files) at each head: a P2 at 1e1c475 and a P3 at ed19b82, both historical notes the pin rewrite had changed, were fixed; be43b4a, the merged head, had no introduced finding. The one pre-existing P3 it found is #1001.
+- #997 (tasks 576 and 579): claude approved task 576 at 894a590f and task 579 at b33ce9a5, the merged head; task 579 carries the follow-up for the codex connector's finding at 894a590f (the incomplete model receipt, so 0.166.0 stays unverified).
+- #1002 (task 578): claude approved 7c167db9, the merged head, after its rebase on de0c4386.
+
+Release merges: #1003 merged release/0.23.1 at 00576eef with a merge commit, cdf35135 (default subject); `release-tag.ts` then refused because #1002's source commits were newer than the stamps. This second release PR records #1002 and restamps.
+
+## Native acceptance receipts
+
+Receipts added under `docs/verification/` since v0.23.0: `docs/verification/2026-10-31-codex-0166-reviewer-isolation.md`, `docs/verification/2026-10-31-codex-0166-reviewer-tool-call.md`, `docs/verification/2026-10-31-kimi-241-reviewer-compat.md`, `docs/verification/2026-10-31-qwen-0264-acp.md`, `docs/verification/2026-10-31-qwen-0264-dual-output.md`.
+
+The release-prepare run printed none; the Codex receipts arrived with #997 and the Kimi and Qwen receipts with #1002 afterwards, and the list above is the same `git diff --diff-filter=A v0.23.0..HEAD -- docs/verification` query on the release branch. That query also drops `docs/verification/2026-10-31-claude-implementer-2.1.314.md` (#996), because its name ends in a version like a release report (`-X.Y.Z.md`); it is a model-free receipt this release rests on.
+
+This list is read from the repository, never written by hand. Native acceptance and the person's release consent are separate records: consent is `ahub sdlc authorize-release 0.23.1`, person only, and is not recorded in this file. The tag run refuses without it.
+
+## Document review
+
+`node scripts/check-docs.mjs --require-fresh` reported 6 stale documents, each stamped at ce8da3ec with #996 (a6497d49) and, except adapters.md and security.md, #998 (95032a74) as source commits. Each was read against those two commits and restamped at 57fe2130:
+
+- README.md: the Status line (release-prepare) and the report link now name 0.23.1.
+- docs/quickstart.md: the install pin is v0.23.1 and an "Upgrading to 0.23.1" note names the amem 0.14.0 pin, the activation order and Claude Code 2.1.314. The current-pin lines were already updated by #998; the historical 0.21.0 note keeps 0.13.0.
+- docs/security.md: the headless implementer receipt sentence now links the 2.1.314 receipt (#996 updated only operations.md). The #525-5 terminal-instance sentence names a different receipt and is unchanged.
+- docs/operations.md: no statement changed; #996 and #998 had updated the receipt and pin lines.
+- docs/agent-notes/adapters.md and tests.md: no statement changed; the compat rule (add a version only with a receipt) and the fixture rules hold for #996.
+- The CHANGELOG gained the missing #996 entry.
+
+After #997 was merged in, the same six documents were stale again with #997 (894a590f, f7f1d546, b33ce9a5) as source commits, and were read against them:
+
+- docs/operations.md: #997 already records the 0.166.0 receipts and why the version stays unverified.
+- docs/security.md: the fresh Codex reviewer sentence lists 0.146.0, 0.163.0 and 0.164.0 as verified, still true.
+- docs/quickstart.md: the 0.23.1 note now separates the hub version (0.23.1, bundling amem 0.14.0) from the amem CLI version (0.14.0), an OCR P2 on the release PR; the 0.12-era reviewer note keeps its historical versions.
+- README.md, docs/agent-notes/adapters.md and tests.md: no statement changed; adapters.md's rule (add a version only with a receipt) holds for the reverted bump.
+- The CHANGELOG gained the #997 entry, and the pin entry got the same hub/CLI wording fix.
+
+At the #1003 merge commit cdf35135 the same six documents were stale again with #1002 (85d265b2) as the source commit, and were read against it:
+
+- docs/security.md: the Qwen ACP peer sentence now lists 0.26.4 and the fresh Kimi reviewer sentence 2.4.1 as receipt-verified. The dual-output owner sentence (measured on 0.26.1) is about `qwen-dual`, still 0.26.1 only.
+- docs/quickstart.md: the 0.23.1 note names Kimi 2.4.1, Qwen 0.26.4, the unchanged dual-output TUI and Codex 0.166.0.
+- docs/operations.md: #1002 already lists the new receipts and the dual-output attempt.
+- docs/agent-notes/adapters.md: its `qwen-dual` lines (verified 0.26.1, the event-file offset measured on 0.26.1) are unchanged by #1002.
+- README.md and docs/agent-notes/tests.md: no statement changed.
+- The CHANGELOG gained the #1002 entry.
+
+## Checks
+
+On dgx02 at ec50a6f9 (the second release PR, after #997 and #1002) with its own frozen install (`@staix/agent-mem` 0.14.0):
+- `node scripts/check-docs.mjs --require-fresh` printed `docs: OK (0 stale documents)`.
+- `bun x tsc --noEmit` was clean.
+- `bun scripts/build.mjs --check` exited 0.
+- `node scripts/check-package.mjs` printed `package: OK (680 files, @staix/agent-hub@0.23.1)`.
+
+The release PR's exact-head CI is the full gate on both OSes.
+
+## Known gaps, not blocking
+
+- No live receipt in this release. The 2.1.314 receipt is model-free; a real account, model and person interaction remains a separate leg.
+- Nothing here activates the amem 0.14.0 v2 public prune view; a home with it active is refused by 0.13.0 readers, including installed hubs older than this release.
+- The running hub on this machine has not been upgraded to 0.23.1.
+- A local full `scripts/check.sh` on dgx02 for #998 was stopped by the hang watchdog (#115/#121); the full suite evidence is the PR and release PR CI on both OSes.
+- Release preparation, the bundle and the checks ran on dgx02 (the Mac runs no heavy work until further notice); dgx02's checkout has no tags, so v0.23.0 was recreated there at 24d685b9 for `release-prepare` only.

package/docs/verification/2026-10-31-claude-implementer-2.1.314.md

@@ -0,0 +1,67 @@
+# Claude Code 2.1.314 headless implementer receipt
+
+Date: 2026-10-31. Scope: #888 (claude-implementer row). This repeats both model-free procedures that `COMPAT["claude-implementer"]` rests on, on the installed Claude Code 2.1.314 with 2.1.310 run through the same producers as a control: the permission transport of the [2.1.310 receipt](2026-10-26-claude-implementer-2.1.310.md) (including the production-name Bash variants of the [2026-10-28 triage](2026-10-28-claude-implementer-permission-triage.md)) and the host shell wrapper of the [wrapper receipt](2026-10-26-headless-claude-shell-context.md). Source head: `24d685b9` (0.23.0). Platform: macOS arm64, host Bun 1.4.3.
+
+Result: every case passed on both binaries. `2.1.314` is added to `COMPAT["claude-implementer"].verified`. 2.1.311 and 2.1.312 are not verified by this receipt.
+
+| Native version | Binary SHA-256 |
+| --- | --- |
+| Claude Code 2.1.310 (control) | `ffb64331bc0ee1b69efb7c2c428bd3ab516bc31b75bf60886b356c97c1c25ffd` |
+| Claude Code 2.1.314 | `21d6e7b9a6f07b4cfcb7df13760b3b72aa25e084e13a5354413382987ba832ed` |
+
+The 2.1.310 hash matches both earlier receipts, so the control is the binary they certified.
+
+## Upstream changes since 2.1.310
+
+Read from the upstream [CHANGELOG](https://github.com/anthropics/claude-code/blob/main/CHANGELOG.md) for 2.1.311, 2.1.312 and 2.1.314 (no 2.1.313 entry). Items that touch permissions, MCP, hooks, settings sources or the Bash tool:
+
+- **2.1.314, `--setting-sources` excluded file still supplied some settings** (auto mode rules, saved permission consents): fixed. The hub launches with `--setting-sources ''`, so this tightens the isolation the hub already assumes; it loosens nothing.
+- **2.1.314, hooks matching Bash now run on shell commands started by the Monitor tool**, able to block or ask but not approve or rewrite. The 2.1.310 receipt already records that Monitor reaches the host prompt tool as `tool_name: "Monitor"`; this changes hook coverage, not the prompt-tool path. A Monitor command is still never rewritten by the host wrapper, which binds Bash only (ceiling unchanged).
+- **2.1.314, `permissions.blockWritesOutsideWorkingDirectories`**: a new opt-in setting the hub does not set.
+- **2.1.314, stream-json acknowledgement of prompts containing `<bash-stdout>`-style tags**: host output framing; the producers parse structured `tool_use_result` frames, not prompt text.
+- **2.1.312, prompt and agent hooks capped at 24 concurrent per session**: the hub runs no prompt or agent hooks in the implementer child.
+- **2.1.311, Bash tool description no longer claims the working directory always persists**: a description change. The wrapper's persistent-cwd control below still observes persistence on 2.1.314.
+- **2.1.311, subagents can use MCP tools from servers that connect late**, and interrupt no longer waits on an unanswered MCP resource read: neither changes the prompt-tool request or reply shape, and the MCP error, disconnect and pending legs are unchanged in outcome.
+
+Nothing in these entries changes `--permission-prompts host`, `--permission-prompt-tool`, `--strict-mcp-config` or the `updatedInput` reply contract. This reading is of the changelog text, not the binary's source, which is not public.
+
+## Runs
+
+Each producer ran both binaries sequentially with an isolated HOME and `CLAUDE_CONFIG_DIR`, a fixture MCP server, a deterministic loopback provider and the literal API key `synthetic-probe-not-a-credential`. No account, provider request or model inference was involved. Every native child's process group was confirmed empty afterwards and every binary hash was unchanged.
+
+```sh
+python3 docs/verification/claude-permission-transport-native.py OUT/write --claude 2.1.310 --claude 2.1.314
+python3 docs/verification/claude-permission-transport-native.py OUT/bash --tool Bash --server-name agent-hub --permission-tool hub_permission_request --require-tool-use-id --claude ... --claude ...
+python3 docs/verification/claude-permission-transport-native.py OUT/rewrite --tool Bash --rewrite-bash --server-name agent-hub --permission-tool hub_permission_request --require-tool-use-id --claude ... --claude ...
+python3 docs/verification/claude-shell-wrapper-native.py OUT/wrapper --bun ABSOLUTE_BUN --claude ... --claude ...
+```
+
+(binary arguments are the absolute installed paths; `--bun` must be an absolute path, a bare `bun` fails the host fixture with `FileNotFoundError`).
+
+| Producer | Cases per binary | 2.1.310 | 2.1.314 |
+| --- | --- | --- | --- |
+| Write transport (allow, deny, missing tool, hook deny/allow, MCP error, disconnect, pending, deadline) | 9 | 9 pass | 9 pass |
+| Bash transport, production server and tool names, `tool_use_id` required | 9 | 9 pass | 9 pass |
+| Bash `updatedInput` command replacement (allow, deny) | 2 | 2 pass | 2 pass |
+| Host shell wrapper (persistent-cwd control, fixed-wrapper rewrite with replay refusal) | 2 | 2 pass | 2 pass |
+
+Per-case shapes on 2.1.314 match the control: allow/deny 2 requests and 1 permission call; missing tool 1 request, 0 calls, native exit 1; pending stopped externally at the 25-second deadline; wrapper control 3 requests and 2 permission calls, wrapper rewrite 4 requests and 3 permission calls with the effect counter at exactly 1 after replay.
+
+The only producer change is the version allow-list in `claude-shell-wrapper-native.py`, which now admits `2.1.314` beside `2.1.309` and `2.1.310`.
+
+| Artifact | SHA-256 |
+| --- | --- |
+| Permission producer | `8f8885f7153b3a236f3b3f8ce49a344b908f2af3b3aba8b064762d82d1ecf12a` |
+| Wrapper producer (this change) | `6834da808c8cd6615a841234ef2e1dfff152cfd2e637908c4542d0bdacdfb053` |
+| Wrapper host fixture | `616e6711e392f0eee7e3fa1c7bdc47a537dfa86bcc8ffb30e549ca94e5a71cef` |
+| Fixed CLI wrapper | `8ff56514a6e3f25bce0784775d396df199b58b1b93f55ad0e8747bbc729d2fd8` |
+| Write receipt JSON | `efea5aa3ec86a6673c5ecfbff051f05591603b8a54b8f78a7e4c672c9e3dc332` |
+| Bash receipt JSON | `9184559d28482dca4a53267cb4b43af7c189fc9105f50708df34b40c23caa3b2` |
+| Rewrite receipt JSON | `c3839e5a3bd612552f6155c960b3bd4cc64df3d937c8fda896f730b6a09f893f` |
+| Wrapper receipt JSON | `6ef5a42e971af4a5c8b6db17449782d38dc0c0b94bf9a93276a9a7caf4324c8b` |
+
+The receipt JSON files stay in the local diagnostic directory; they carry local paths and are not committed.
+
+## Evidence boundaries
+
+Unchanged from the earlier receipts: no real provider authentication, model tool selection, person approval interaction, task-session resume or production-daemon task binding is proved, and this is not a runtime receipt gate. Native version admission and binary fencing remain required. The Monitor tool is still an unrewritten prompt-tool path. Exact-head package gate and CI are recorded on the PR.

package/docs/verification/2026-10-31-codex-0166-reviewer-isolation.md

@@ -0,0 +1,52 @@
+# Codex 0.166.0 fresh-reviewer isolation receipt
+
+Date: 2026-10-31. Platform: macOS arm64, Bun 1.4.2. Scope: issue #888, task 576. This repeats the [0.164.0 model-free production preparation](2026-10-24-codex-0164-reviewer-isolation.md), retaining the 0.146.0 control and the earlier evidence boundaries. Source base: `a6497d495759e8a1176eb95dc19e31eaff5dbb70` (0.23.0). No `codex exec`, model request, login, credential copy or live reviewer run was performed. The returned launch was inspected, never started. The person's real HOME and `~/.codex` were never supplied to a Codex process.
+
+Result: all four model-free legs returned the expected outcome. The subsequent [one-run model-backed receipt](2026-10-31-codex-0166-reviewer-tool-call.md) persisted an approved native verdict but failed its required synthetic-marker readback. The proposed 0.166.0 verified bump was therefore reverted. Both 0.165.0 and 0.166.0 remain unverified; this positive model-free inventory alone does not qualify a version.
+
+## Source identity and re-read regions
+
+`git ls-remote https://github.com/openai/codex.git 'refs/tags/rust-v0.166.0' 'refs/tags/rust-v0.166.0^{}'` returned annotated tag object `593389380740f7b4762771573c447ccfdc59742f` and peeled commit `6ff1e1ca3b30fc8b914720681fcf5fe62e95f856`. The same readback retained the earlier 0.164.0 tag object `fe3b29455488c2e189e43ad5526a107900c5e1b7` and peeled commit `6aaac694803004a63c6f393d153c96d22521a6b9`, matching its receipt.
+
+Each of the seven files below was fetched successfully at the 0.166.0 peeled commit in the remote source-analysis workspace. The implementation regions were read, including moved anchors, rather than inferring behavior from matching names or old line numbers.
+
+- [Exec switches, lines 40-50](https://github.com/openai/codex/blob/6ff1e1ca3b30fc8b914720681fcf5fe62e95f856/codex-rs/exec/src/cli.rs#L40): ephemeral sessions, ignoring the user config file and ignoring user/project execpolicy rules remain independent global exec switches. Auth still uses CODEX_HOME; ignoring user config does not remove every configuration layer.
+- [Apps projection, lines 279-285](https://github.com/openai/codex/blob/6ff1e1ca3b30fc8b914720681fcf5fe62e95f856/codex-rs/core/src/mcp.rs#L279) and [registration, lines 464-485](https://github.com/openai/codex/blob/6ff1e1ca3b30fc8b914720681fcf5fe62e95f856/codex-rs/core/src/mcp.rs#L464): disabling MCP servers clears the Apps gate; implicit Apps registration still requires Apps enabled and a session without isolated-session metadata, and is removed otherwise. Configured MCP inventory alone cannot prove this runtime server absent, so effective feature readback remains required.
+- [Plugin manager, lines 831-834](https://github.com/openai/codex/blob/6ff1e1ca3b30fc8b914720681fcf5fe62e95f856/codex-rs/core-plugins/src/manager.rs#L831): disabling plugins returns the default empty load result before plugin discovery.
+- [MCP schema, lines 243-245](https://github.com/openai/codex/blob/6ff1e1ca3b30fc8b914720681fcf5fe62e95f856/codex-rs/config/src/mcp_types.rs#L243) and [291-297](https://github.com/openai/codex/blob/6ff1e1ca3b30fc8b914720681fcf5fe62e95f856/codex-rs/config/src/mcp_types.rs#L291): a disabled server is not initialized; enabled tools restrict exposure, and disabled tools filter that result afterwards.
+- [Session hook configuration, lines 5735-5743](https://github.com/openai/codex/blob/6ff1e1ca3b30fc8b914720681fcf5fe62e95f856/codex-rs/core/src/session/mod.rs#L5735) and [registry, lines 179-197](https://github.com/openai/codex/blob/6ff1e1ca3b30fc8b914720681fcf5fe62e95f856/codex-rs/hooks/src/registry.rs#L179): legacy notify arguments are copied independently of the hooks feature. A non-empty legacy command becomes an after-agent hook independently of the engine feature flag. The [session-static comment, lines 2389-2392](https://github.com/openai/codex/blob/6ff1e1ca3b30fc8b914720681fcf5fe62e95f856/codex-rs/core/src/session/mod.rs#L2389) remains. The host therefore still pins `notify=[]` for metadata proofs and the returned exec argv; no model-driven notify execution is claimed.
+- [Seatbelt glob compiler, lines 624-705](https://github.com/openai/codex/blob/6ff1e1ca3b30fc8b914720681fcf5fe62e95f856/codex-rs/sandboxing/src/seatbelt.rs#L624): unreadable globs produce anchored read/write denies, canonicalized static-prefix variants and directory-unlink denies for ancestors. The root-recursive literal-basename form still protects descendants without needing ancestor guards.
+
+## Native production preparation
+
+A throwaway producer outside the source checkout invoked the actual `codexReviewerBackend.prepare`. A frozen install in this worktree supplied the exact `@staix/agent-mem@0.13.0`; the producer checked that local package version before importing the backend. Each leg used fresh project, HOME, CODEX_HOME and TMPDIR directories under its own temporary root. A child received only PATH, LANG, HOME, CODEX_HOME, TMPDIR and a fixture-root marker. Before importing the production backend, it rejected extra environment variables, a mismatched `os.homedir()`, or any home/project/temp directory outside that root. No real configuration or credentials were copied. The MCP transport was inert `/usr/bin/false`, without a control token, and private paths were `**/*.env`, `.private`, `nested/secret` and `~/private-proof`.
+
+The command was the explicitly selected installed npm `codex.js` launcher, resolved by production to its native arm64 binary. The control used the retained Homebrew npm launcher. Both native binaries remained outside the project and the producer checked the returned receipt, stable `current()` binding and empty notify override. Production `prepare` ran its own metadata and native sandbox canaries. Temporary homes and canaries were removed after each leg; the returned exec launch was never executed.
+
+| Leg | Outcome | Elapsed |
+| --- | --- | --- |
+| Before compat edit, 0.166.0, empty homes | Refused only at version admission, `causeClass: version`; previous verified set 0.146.0, 0.163.0, 0.164.0 | 122.32 ms |
+| After exact 0.166.0 addition, empty homes | All production preparation legs pass | 344.82 ms |
+| After addition, synthetic ambient config | All production preparation legs pass | 352.80 ms |
+| Retained 0.146.0 control, empty homes | All production preparation legs pass | 477.53 ms |
+
+The ambient file enabled Apps, plugins and hooks, supplied a legacy notify command and declared one stdio and one HTTP MCP server. Metadata preparation disabled the ambient servers, retained only the hub server with exactly `hub_review` and `hub_task_show`, and proved effective Apps/plugins/hooks disablement. Per-tool approval remains configured only for those two hub tools; actual MCP tool execution is outside this receipt.
+
+| Version | Native binary SHA-256 | Production binary identity |
+| --- | --- | --- |
+| 0.166.0 | `39acf979729dd290f9a24ee38b2914e036c91b65952872e28ae2a6b88a7db7c1` | `sha256:77c2eae1013cec5acaa8a2d980bb760a7ca7657ebb9cb3033550cad787ab2fdd` |
+| 0.146.0 | `ae1d3ffe6d48aec6a4dc3f50e7eb8e0d11962485a6a9406c5a7012139383da02` | `sha256:4a6398187165c5bd75ad92c9a6fba6df6d401a59b62f7e1ecf9218a8196852a6` |
+
+The production identity hashes the native file digest again, so it differs from the direct binary digest. The 0.146.0 production identity matches the earlier receipts.
+
+All successful launches returned `backend: codex`, `readOnly: true`, `strictMcp: true`, `ephemeral: true`, `current(): true` and `notify=[]`. Their evidence lists were identical: `model-free-mcp-inventory-disabled-ambient`, `hub-tools-exact-allowlist`, `plugins-and-hooks-disabled`, `legacy-notify-disabled`, `apps-disabled-effective-feature-readback`, `web-search-disabled`, `project-untrusted`, `native-public-read-private-deny-write-deny`, `native-glob-and-symlink-private-deny`, `portable-core-name-and-state-deny`, `standard-host-credential-roots-denied`, `binary-config-stable`, `binary-hash-once-metadata-fence`, `session-ephemeral`.
+
+Native canaries passed for a public read, denied exact private read, denied nested private glob and symlink alias, denied portable-core `.env` and `.agenthub/state`, denied synthetic gh/kube/docker credential roots and credential alias, and denied creation of a new file with the file remaining absent. Production's metadata commands retain their existing 2-second command and 12-second overall limits and owned-group cleanup; none failed.
+
+## Compatibility and evidence boundaries
+
+The verified reviewer versions remain 0.146.0, 0.163.0 and 0.164.0 after the incomplete model-backed receipt. The existing 0.165.0 unverified/trust fixtures stay unverified. The exact-version test now refuses 0.166.0 as well as 0.166.1, 0.167.0, a prerelease and a prefixed string. Capability pins for the attached Codex adapter are a separate contract and unchanged. No isolation implementation, sandbox ceiling or trust bypass changes.
+
+The network setting is configured disabled without a separate network probe. Web search is requested disabled without model-turn readback. No run proves exec selecting the named default profile, model tool selection, real account authentication or verdict delivery. The [0.164.0 model-backed tool-call receipt](2026-10-25-codex-0164-reviewer-tool-call.md) is evidence for that version only. A separately authorized [0.166.0 model review](2026-10-31-codex-0166-reviewer-tool-call.md) did reach persisted native verdict delivery, but its required synthetic marker was missing, so the full receipt remains failed. No model retry was made. No native Linux result is claimed. Same-user mutation after the final metadata check is outside atomic snapshot guarantees, and the bounded credential-root list is not a classifier for every private host file.
+
+Source claims apply to this peeled 0.166.0 commit only. Each upgrade repeats the procedure; the throwaway producer is not a new supported command. Raw local probe records carry temporary paths and stay outside git. The pinned-Bun bundle rebuild, changed-source gate and exact-head hosted CI are separate evidence recorded on the PR.

package/docs/verification/2026-10-31-codex-0166-reviewer-tool-call.md

@@ -0,0 +1,49 @@
+# Codex 0.166.0 reviewer tool-call receipt, failed marker check
+
+Result: the single authorized native review persisted one approved verdict through production stdio MCP and `Tasks`, but the required private synthetic marker was absent. The full receipt failed and 0.166.0 was removed from the proposed verified set. No model retry was made. Date: 2026-10-31, macOS arm64, Bun 1.4.2. Scope: issue #888, task 579, PR #997 connector P1. The positive [model-free receipt](2026-10-31-codex-0166-reviewer-isolation.md) remains available and does not independently qualify the version.
+
+## One production review
+
+This repeated the [0.164.0 fixture](2026-10-25-codex-0164-reviewer-tool-call.md) using the actual `startDaemon`, `ReviewerPrintPeer`, `codexReviewerBackend`, stdio plugin and `Tasks`. A temporary builder proposed and accepted one synthetic arithmetic task. Its temporary console assigned `codex-review`; builder completion triggered the real native reviewer. The harness never invoked `hub_review` itself or substituted a tool result.
+
+Read-only SQLite inspection found state `approved`, reviewer `codex-review` and exactly one persisted reviewer verdict. The stored task refs and running-child binding matched the synthetic fixture head. Two successful `hub_review` observations were retained at the production trace observer; host and native observations may duplicate one invocation, so they are not claimed as two distinct calls. No `hub_task_show` observation was retained.
+
+The private-marker check returned false. The marker was placed in task detail, while the accepted plan contained no marker. Current `Tasks.reviewRequest` omits task detail when a rendered plan is present. This is a fixture-visibility concern, but the retained metadata does not establish whether model omission or host screening caused the missing marker. Raw prompts and model prose were not preserved. The next attempt's fixture correction is to place the marker in the done summary or accepted plan, where the reviewer is actually shown it, and assert model-free that the rendered review request contains it before consuming a new model-run authorization. This is a fixture correction, not an established 0.166.0 defect. Successful native verdict persistence does not waive this task's explicit marker requirement.
+
+| Evidence | Observed |
+| --- | --- |
+| Tested source head | `894a590fd0c1312adb165ace5b49f0d542185b41` |
+| Native version / production binary identity | 0.166.0 / `sha256:77c2eae1013cec5acaa8a2d980bb760a7ca7657ebb9cb3033550cad787ab2fdd` |
+| Backend source SHA-256 | `8e6ce4e64c6787a81e48a97172d25bbf1876ae5bc24a54934e7a107075a72214` |
+| Stdio plugin SHA-256 | `2cc09f4fd8916861586fe2d962e6520437b555bc4590df319fde0b614a43a879` |
+| Startup profile SHA-256 | `cf0eded7535d42f115de1675929c889fc9ccae3aebb451f2a922e02dea4ce3da` |
+| Actual review profile SHA-256 | `dcadeea11ba12471f6a2f7cfd30a86c362758d846d50e2ccaf7347a17c9ca148` |
+| Fixture task / reviewer | 1 / `codex-review` |
+| Fixture head | `9ef3805146367c58d391afb25816056107433e9d` |
+| Persisted state / verdict count | `approved` / 1 |
+| Stored refs and running review head matched | true |
+| Required marker matched | **false** |
+| Marker SHA-256 | `a62118802585320868c5432c031e3c40c841a8a7e92674e700eefaaf476abea6` |
+| History SHA-256 | `aac0fab5efe89e27cfe14fb186e04df0d24c011d80f9156ca0a9b9083645e069` |
+| Review attempts / delivery states / final peer state | 1 / accepted, completed / idle |
+| Fixture start / verdict readback, UTC | 03:54:18.164 / 03:54:36.045 |
+
+## Isolation, authorization and cleanup
+
+The controller acquired the local repository lock before creating fresh HOME/CODEX_HOME and one auth.json symlink to the configured account. No personal configuration or credential value was copied or read by the harness. 17 bounded private roots covered the original account and the original HOME's credential locations, in addition to production's private state and native canaries. No production task, daemon, PR assignment or personal machine trust was changed by the fixture.
+
+The actual review receipt retained `readOnly: true`, `strictMcp: true`, `ephemeral: true` and all 14 model-free evidence markers. Effective Apps/plugins/hooks and legacy notify remained disabled; only the two hub review tools were configured, with per-tool approval overrides. The existing public-read, private/glob/symlink, portable-core, credential-root and write-denial native canaries passed. No separate effective network-isolation or web-search model-turn readback is claimed.
+
+A persistent exclusive authorization file and a wrapper around the original production review entry prohibited a second review attempt. The trace observer delegated to the original method and recorded only tool names, refusal booleans and the immutable running head. It did not grant tool or verdict authority. The immutable backend object and production source were not changed. The fixture deadline remained 110 seconds and controller deadline 120 seconds.
+
+Before the actual run, a setup-only attempt failed while installing an observer on the immutable backend, before daemon startup, an auth link or any model review. The corrected setup-only attempt passed with zero native preparations and zero model requests, without an auth symlink. This did not consume the actual model authorization.
+
+After the one actual attempt, production daemon/process-group teardown was awaited, the driver group was absent and an additional fixture-root argv scan found zero matching processes. The controller released only its own inode/owner-bound lock. The auth symlink, fresh homes, project, task state and temporary directory were removed. This is bounded cleanup evidence, not universal orphan detection. The fail path did not separately read back the synthetic source file before removing it, so no measured unchanged-source claim is made for this attempt.
+
+The source-account auth metadata was unchanged before/after: both hashes were `09a890fea6df1c2c40e746b479336e26d74482127916449126e37930bba9b62f`, without reading credential contents. Private proof metadata was mode 0600, 3477 bytes, SHA-256 `680ed4ee54b7c7825a6472e14c66e74295b7aa84c689f67421c5e01c9676a252`; the harness output log was empty. Account paths, token values, marker value and model prose are omitted here.
+
+## Decision and limits
+
+The connector finding is addressed by removing automatic version admission. Verified versions remain 0.146.0, 0.163.0 and 0.164.0; the ordinary person-owned exact-version trust path and all runtime proofs remain unchanged. This failed receipt is preserved alongside the positive model-free inventory. Any later model attempt needs a new authorization; none is implied by this record.
+
+This establishes that a native 0.166.0 verdict reached the temporary production host boundary. It does not establish the complete required marker-bearing receipt, production deployment, Linux behavior or every reviewer workflow. The changed-source gate and hosted CI at the subsequent documentation/rollback head are separate evidence on the PR.

package/docs/verification/2026-10-31-kimi-241-reviewer-compat.md

@@ -0,0 +1,63 @@
+# Kimi 2.4.1 fresh-reviewer compatibility receipt
+
+Date: 2026-10-31. Scope: issue #888, task 578. This repeats the [2.3.2 model-free procedure](2026-10-26-kimi-232-reviewer-compat.md), with the actual production preparation and native tool-call loop driven by fixed loopback responses. The broker callback is synthetic: no real account, inference or persisted `Tasks` verdict was run. No real Kimi home, global prefix, personal trust or hub instance was changed.
+
+## Artifact and installation
+
+| Artifact | Binding |
+| --- | --- |
+| Upstream annotated tag | `@moonshot-ai/kimi-code@2.4.1`, tag object `1fc1d165c83b175873a46897e1e9db73dc70c984` |
+| Peeled source commit | `2c73f3f50af4fa7f2540ca0d2e33b07a1408e3a7` |
+| Official macOS arm64 archive | `kimi-code-darwin-arm64.tar.gz`, 62,671,109 bytes |
+| Archive SHA-256 | `17f848e7b9b159aed9b2ad0df917c4be3c484393d924a6540171ede7b87cc66d` |
+| Standalone executable SHA-256 | `1a8539eae87ffbd9bf480b8a47beafc9668f66b048b96cfa631310dc12dab3a7` |
+| Host / hub core | macOS arm64, Bun 1.4.2, own frozen `@staix/agent-mem@0.14.0` |
+
+The archive was obtained from the official release at that tag and checked against both its GitHub asset digest and sibling checksum file before bounded extraction into a new scratch prefix. No global installer ran. An earlier privately installed npm 2.4.1 distribution also passed the same two probe modes at the 0.13.0 hub-core checkpoint; its Node entry hash is `fd15d5c9b48892bb4f1d5fe82df9f790c8c19a44ca9a81054cc592b6fb9e2c90`. The primary receipt below is for the standalone executable, matching the previous artifact form. After rebasing onto main with the 0.14.0 core pin, both standalone modes were repeated successfully against that exact frozen dependency; prior 0.13.0 records remain separate. The npm postinstall was reviewed and invoked only in non-global mode, where it returns before global shim migration.
+
+## Isolated production and native controls
+
+The existing producer was adapted to require the private executable path and current source checkout, assert its own exact dependency version, and use the ordinary macOS temporary root. It created fresh HOME, native KIMI_CODE_HOME, cwd, skills and temporary directories with only synthetic managed-provider config, an invented access-only OAuth record and device identity. The production backend made its own private config/agent/MCP files and linked only these fixture credential directories. No personal credential or config was copied.
+
+The original managed-provider endpoint was used for production config validation. A separate owned native fixture copied the generated config and redirected only its provider/OAuth endpoint and scoped synthetic credential slot to a fixed loopback server. The prepared original stayed unchanged, preserving its `current()` check. The synthetic provider emitted tool-use frames and fixed final text; it performed no inference. Application-level network preloads and a separate positive control blocked non-loopback attempts; this is not kernel network isolation.
+
+Two complete standalone runs passed:
+
+| Leg | Fixture-trust run before Kimi bump | Verified run without trust |
+| --- | --- | --- |
+| `kimiReviewerBackend.prepare`, version/current/private config/replace env | pass | pass, `fixtureTrustOnly: false` |
+| Exact two MCP tools and `subagents: []`, config mode 0600, empty skills | pass | pass |
+| Task-bound MCP wrong task, third tool, missing auth and revocation refusals | pass | pass |
+| Actual native two-tool loop, four fixed-response requests | pass | pass |
+| Injected Write absent from inventory, native tool-not-found result, marker unchanged | pass | pass |
+| Explicit Write positive control, two requests, marker written | pass | pass |
+| Trust-workspace environment decoy removed from launch env | pass | pass |
+| Owned groups, original synthetic config/credential bytes and temporary-tree cleanup | pass | pass |
+
+Every native two-tool request advertised exactly `mcp__agent-hub__hub_review` and `mcp__agent-hub__hub_task_show`. Both calls reached the production task-bound broker and its synthetic callback. Wrong task id, a third tool and missing authorization were refused; revocation refused reads. The callback never invoked a real task board or persisted a reviewer verdict. The positive control explicitly added Write to the agent, proving the absent Write effect in the restricted run came from the native tool allowlist.
+
+The first run used only an invented trust record in its temporary hub home while 2.4.1 was absent from the source verified set. The second used the proposed exact verified entry and asserted the `verified` assessment without a trust record. No real machine trust was written.
+
+## Source review
+
+The old 2.3.2 source readback still resolves to `b8dd3a134060c6e80ba4a1659335cd63b68483f2`. The 2.4.1 tag above was independently read back. This was a scoped contract review at both commits, not a review of all changed UI assets or commits.
+
+- `workspaceTrust/trustEnv.ts`, agent-file parsing, builtin tool assembly, native managed Kimi OAuth binding and `packages/oauth/src/oauth-manager.ts` were byte-identical in the inspected regions/files.
+- [Workspace MCP config service](https://github.com/MoonshotAI/kimi-code/blob/2c73f3f50af4fa7f2540ca0d2e33b07a1408e3a7/packages/agent-core-v2/src/workspace/workspaceMcpConfig/workspaceMcpConfigService.ts) adds reconnect-delay tunable change notifications and retains the deferred/startup/tool timeout fields. The native explicit two-tool inventory and actual broker calls above exercise the relevant result rather than inferring it from defaults.
+- The 2.3.3, 2.4.0 and 2.4.1 changelog entries were read for plan-mode, MCP loading, trust, tool and subagent changes. Plan-mode entry is now user-controlled; print mode skips the default plan mode. Dynamic MCP loading fixes do not bypass the observed exact agent allowlist. The 2.4.1 read-tool output ceiling is outside an agent that has no native Read tool.
+
+## Decision and limits
+
+All required Kimi model-free legs passed, so exactly 2.4.1 may join `COMPAT["kimi-review"].verified`; 2.4.0 and other nearby versions remain unverified. This follows the existing 2.3.1/2.3.2 model-free Kimi procedure. The receipt records synthetic broker execution, not a real-account or persisted-Tasks verdict. No reviewer is enabled or launched on the actual hub by this change.
+
+Real account/login/provider readiness, OAuth refresh under a real token, attached-TUI coexistence, model behavior/quality, token usage/quota and other platforms remain unverified. Kimi's native tool-authority boundary is not a kernel filesystem sandbox. Frozen-install, pinned-Bun bundle freshness, host changed gate and exact-head CI are separate PR evidence.
+
+## Evidence fingerprints
+
+Producers and result JSONs stay outside git under `scratchpad/temp/agent-hub-578`.
+
+| File | SHA-256 |
+| --- | --- |
+| `kimi-probe.ts` | `5985aef11fb111f3f04640323130dfae98fd8f6934d4be4433307b89abdee8a5` |
+| `kimi-native-result.json` | `0c4838f66835220103b525f05354fbe8729c1de236ec674c1eeeb9e2d05d0951` |
+| `kimi-verified-result.json` | `e69bfd33569139e05788e8c29a3a45aeb92526eb7c3cba11b402b615cfb6583c` |

package/docs/verification/2026-10-31-qwen-0264-acp.md

@@ -0,0 +1,57 @@
+# Qwen Code 0.26.4 ACP receipt
+
+Date: 2026-10-31. Scope: issue #888, task 578, `qwen` row only. This repeats the [0.26.1 ACP receipt](2026-10-26-qwen-0261-acp.md) using a private npm prefix, isolated HOME and fixed synthetic configuration. No account, real credential, provider inference or ACP prompt was used. This receipt does not admit the separate `qwen-dual` contract.
+
+## Artifact and isolation
+
+The published `@qwen-code/qwen-code@0.26.4` was installed under `scratchpad/temp/agent-hub-578/qwen-prefix`, with scratch HOME, cache, temporary directory and separate empty npm user/global config files. The person's global prefix and `~/.qwen` were not installation targets. npm's pending lifecycle script for the optional audio package was read and replayed under the same isolated environment; it completed. No install scripts were disabled to make the probe pass.
+
+| Artifact | Binding |
+| --- | --- |
+| npm release | 0.26.4, `gitHead` and upstream `v0.26.4` tag `715a550cfca0135e00d4015d1ca82a8167e81fff` |
+| npm integrity | `sha512-YeRiUaH3d+JxPiYUS4eGalsKRTuIEUo75JWPWdVBoptdbAH3FJdWbGtjs/syECEUTH5qk0nu8tRb1HMEKn0I2Q==` |
+| `cli-entry.js` SHA-256 | `113efe4104a9fc66f507d34bfd6abbd896ceb77de47f4b468a0825a327fdc6a5` |
+| `chunks/acpAgent-D7OFGHAI.js` SHA-256 | `67d040491bb04e33a2f91df3f142ba09a100333edb1e5f92ed0a84edb1c499b9` |
+| Host | macOS arm64, Node 24.18.1 |
+
+Every native process received a fresh ordinary OS temporary HOME/cwd, private QWEN_HOME/QWEN_RUNTIME_DIR/XDG_CONFIG_HOME, a synthetic API key and `--auth-type openai --model fixture-model --openai-base-url http://127.0.0.1:9/v1 --telemetry=false`. A Node preload denied application network APIs and recorded six blocked startup attempts; none connected through those guarded APIs. A separate reserved-address positive control proved the guard blocks. This is preload evidence, not a kernel network sandbox or a claim about arbitrary native subprocess sockets.
+
+## Native ACP, no prompts
+
+`qwen --acp --bare --advisor off` initialized with protocol version 1 and `agentInfo` name `qwen-code`, title `Qwen Code`, version `0.26.4`. The only offered authentication method was the synthetic OpenAI terminal method. No prompt was sent.
+
+`session/new` succeeded. Available modes were `plan`, `default`, `auto-edit`, `auto` and `yolo`, with current mode `default`. Each transition in `default -> auto-edit -> yolo -> default` returned an acknowledgement. Thus the hub's existing ask/default, ask-when-needed/auto-edit and never-ask/yolo map remains a subset of the native advertised ids; neither `plan` nor `auto` is newly mapped. The session exposed only the fixture model. Additional native mode-update notifications remain outside the hub's mapped protocol.
+
+The native leader exited after its owned group received SIGTERM, and the producer confirmed `groupGone: true`. Six startup network attempts were blocked; the input contained zero model prompts.
+
+## Actual published permission handler
+
+An exports-only scratch copy of the published ACP chunk was placed beside the original inside the private package, preserving its relative imports. The original chunk was not edited. The fixture invoked the actual `SubAgentTracker.createApprovalHandler` with synthetic client/tool/event ports, not a reimplementation or a model-generated tool turn.
+
+- A request carried the fixture session, pending tool-call id, raw input, native MCP tool metadata and permission progress updates.
+- The exact options were `proceed_always_project` and `proceed_always_user` as `allow_always`, `proceed_once` as `allow_once`, and `cancel` as `reject_once`.
+- An offered allow-once response reached `event.respond` as `proceed_once`.
+- A second actual callback with a cancelled outcome reached `event.respond` as `cancel`.
+- The real outcome helper rejected an unoffered option. No permission-fixture network attempt was recorded.
+
+## Source review and boundary
+
+The published npm `gitHead` matches upstream `v0.26.4`; `v0.26.1` remains `b475278c4a300acebe6cfc990a9e1b1d18819bfc`. Release notes for 0.26.2, 0.26.3 and 0.26.4 were read, together with the relevant source regions at both commits. This was a scoped contract review, not a review of every changed file.
+
+- [`SubAgentTracker`](https://github.com/QwenLM/qwen-code/blob/715a550cfca0135e00d4015d1ca82a8167e81fff/packages/cli/src/acp-integration/session/SubAgentTracker.ts#L312) adds subagent identity to emitted progress metadata. The permission request construction and offered-outcome translation remain exercised by the native chunk fixture above.
+- [`acpAgent`](https://github.com/QwenLM/qwen-code/blob/715a550cfca0135e00d4015d1ca82a8167e81fff/packages/cli/src/acp-integration/acpAgent.ts#L6979) still routes mode changes to the selected session. New workflow options, workspace controls and shared fresh-prompt execution are outside the mode ids the hub maps. The idle native mode acknowledgements above are observed; a fresh model prompt through the new chain is not claimed.
+- `DualOutputBridge.ts` and `RemoteInputWatcher.ts` were byte-identical between these tags. That source fact is not native dual-output acceptance; its separate receipt owns that decision.
+
+Every required ACP leg passed. Exactly 0.26.4 may join `COMPAT.qwen.verified`; no intermediate release, compatible range or dual-output version is inferred. A real model-generated permission turn, real login/provider, model behavior, Linux and Intel macOS remain unverified. Host changed-source checks and exact-head CI are separate PR evidence.
+
+## Evidence fingerprints
+
+Producers and result JSONs remain outside git under `scratchpad/temp/agent-hub-578`.
+
+| File | SHA-256 |
+| --- | --- |
+| `qwen-acp-probe.py` | `f36a03010af657f5cc453c4dbfa70ee03014a09d8bf144f6d8c5441de80ccea8` |
+| `qwen-acp-result.json` | `b3a53e394f9234ba8e2c8744e2b892cbbdffe1eac28623d13815efaa7ab7a44d` |
+| `qwen-permission.mjs` | `00d9b68f4a23f3efc84bf657f5c57cea476e36d0469e356b943abb8dcc417587` |
+| `qwen-permission-result.json` | `958a77ea7618e0efd04a78520aadf83654e5b74a0158a05061d0bed4406d7c31` |
+| `deny-network.cjs` | `361148af658dd4b65ed35308622ec99bb882ec5a25fab54581776546f139e892` |

package/docs/verification/2026-10-31-qwen-0264-dual-output.md

@@ -0,0 +1,52 @@
+# Qwen 0.26.4 dual-output attempt, not qualified
+
+Date: 2026-10-31. Scope: issue #888, task 578, the separate `qwen-dual` row. The [ACP receipt](2026-10-31-qwen-0264-acp.md) does not qualify the TUI contract. This attempted the [earlier Q2-Q7 procedure](2026-10-25-qwen-dual-output-t0.md) using fixed OpenAI-compatible loopback responses, no real model, account or credential. Exactly 0.26.1 remains in `COMPAT["qwen-dual"].verified`; 0.26.4 is not admitted.
+
+## Artifact, scope and controls
+
+The candidate is the private-prefix npm `@qwen-code/qwen-code@0.26.4`, upstream tag/gitHead `715a550cfca0135e00d4015d1ca82a8167e81fff`, Node 24.18.1 on macOS arm64. Artifact integrity and entry/chunk hashes are in the ACP receipt. The retained global 0.26.1 executable was used only as a read-only matched control, always with a fresh temporary HOME/cwd and the same producer/flags; no code was injected into that installation. Its `cli-entry.js` SHA-256 `113efe4104a9fc66f507d34bfd6abbd896ceb77de47f4b468a0825a327fdc6a5` matches the earlier receipt.
+
+Each fixture used PTY 120x40, private input/event files, a scratch git project, synthetic OpenAI-compatible key/model, and a loopback server emitting fixed text/tool-use responses. Native shell and stdio-MCP effects were confined to synthetic marker files. Node builtin TCP/DNS/fetch/UDP guards allowed only loopback and fixture-local IPC. Positive controls passed, every launched native Node PID and observed Node child had a preload record, every owned process group was confirmed gone, and temporary roots were removed. These are application-preload and bounded process observations, not a kernel network sandbox or universal subprocess audit.
+
+## Corrected fixture and observed outcomes
+
+The first producer reported Q2/Q4/Q6 failures on both 0.26.4 and matched 0.26.1. Its Q2 error combined two conditions without retaining which failed; its Q4 required bootstrap-leader survival in addition to the original turn-continuation criterion and signalled the entire group; its Q6 stopped at assistant text before the documented message_stop/persistence boundary and selected the first matching fixture marker from provider input. Those results did not establish new-version regressions and were retained.
+
+The second producer kept the required assertions and added causal observations: wait for a native stream delta before the second submit; require final assistant plus following message_stop; wait until the owned session recording contains the final assistant before restart; classify the latest matching fixture marker and retain all marker matches; bind SIGINT to the actual native TUI PID by input-file argv, process group and start identity. It recorded the separate Q2 diagnostics and event chronology. No timeout was increased and no assertion for a separate queued user turn was removed.
+
+| Check | 0.26.4 corrected producer | Matched 0.26.1 control |
+| --- | --- | --- |
+| Q7 version and guard positive control | pass, 0.26.4 | bound separately to installed 0.26.1; not selected in diagnostic run |
+| Q2 second submit becomes a separate user turn after the first completes | **not reproduced** | **not reproduced with the same fixture** |
+| Q3 shell allow/deny, TUI Enter, duplicate reply, read-only control | pass | not selected |
+| Q3 native MCP can_use_tool, exact input and one handler effect after allow, duplicate refused | pass | not selected |
+| Q4 external cancel/SIGINT leaves turn running; person Esc stops it and next turn works | pass, existing ceiling retained | pass |
+| Q5 unread output FIFO does not block the TUI answer | pass | not selected |
+| Q6 resume id, no old-submit replay and prior context present in resumed provider request | pass | pass |
+
+For Q2 the corrected results in both versions report `prematureSecondUser: false` and `userCount: 1`. The one final assistant carries responses to both submitted markers and one completion boundary; the required second distinct user event is absent. This supports a coalescing/steering observation for this held-stream workload, not a new 0.26.4 regression. The earlier receipt's queued-submit observation was not reproduced by this fixture, so this row cannot be called fully verified.
+
+Q3 saw actual shell and `mcp__t0__t0_echo` requests with request id, tool_use_id, exact input and permission_suggestions. Allow and TUI Enter produced the effect and success response; duplicate responses were errors without a second effect. The denied file was absent, the legacy no-event ceiling was observed and a subsequent turn worked. The read-only command ran without approval. MCP execution reached the tiny fixture's handler only after allow and exactly once.
+
+Q4 records an identity-bound native TUI signal, not a promise that the hub may signal a person's terminal. The hub's existing report-only watchdog remains unchanged. Q6 rotated the event file like the production adapter, retained old input bytes without replay and observed the remembered token in the resumed provider request. Model recall quality is unverified because all responses were deterministic fixtures.
+
+## Source review and decision
+
+At 0.26.1 `b475278c4a300acebe6cfc990a9e1b1d18819bfc` and 0.26.4 `715a550cfca0135e00d4015d1ca82a8167e81fff`, `DualOutputBridge.ts` and `RemoteInputWatcher.ts` were byte-identical. The installed UI callback/queue regions also retain direct addMessage and mid-turn steering paths. This is scoped supporting source evidence; the matched native control above determines the attribution limit.
+
+Because Q2 is not established, the conditional task gate does not permit a qwen-dual bump. Only the independently passing ACP and Kimi rows are changed. No TUI adapter, queue, cancellation policy or existing 0.26.1 admission is modified. Resolving this stronger queued-turn workload is separate from declaring a new-version regression.
+
+Real account/provider, inference, model choices/quality, token/quota behavior and non-macOS platforms remain unverified. The evidence includes explicit failed and unselected diagnostic legs; none is relabelled as a pass. Host unit tests/changed gate and exact-head CI are separate PR evidence.
+
+## Evidence fingerprints
+
+Files remain outside git under `scratchpad/temp/agent-hub-578`.
+
+| File | SHA-256 |
+| --- | --- |
+| `qwen-dual-probe.py` | `6111ed0364a498b15d8abbf5353d00ec9289add7dcbc8a57ac0441a2c815af3c` |
+| `qwen-dual-result.json` | `247e7ade2eb001e14b6492cdeb570e6a899b7b83c4873571e5624821d1f0f44b` |
+| `qwen-dual-0261-control-result.json` | `fa47606403a642bda78ea71d810b837c807bc5a36f7b1097ec54c9d7f64d099f` |
+| `qwen-dual-probe-v2.py` | `114c032afce5caef4f59072f0a1730bc78a70788fd49ad17e5ff2f1eef4c947e` |
+| `qwen-dual-v2-0261-control-result.json` | `9b3a9940e43d73c2223d51aec8826053ff24a13b08e1fee4db854d2197053564` |
+| `qwen-dual-v2-0264-result.json` | `15f9b3971f0de3eb48cd6f5735927592b6a20a782641fddb5ca070846b628844` |

package/docs/verification/claude-shell-wrapper-native.py

@@ -68,7 +68,7 @@ results=[]
 for raw_binary in args.claude:
  binary=pathlib.Path(raw_binary).resolve(); identity=ROOT/('identity-'+binary.name); identity.mkdir()
  version=subprocess.run([str(binary),'--version'],env={'HOME':str(identity),'CLAUDE_CONFIG_DIR':str(identity/'config'),'PATH':'/usr/bin:/bin'},capture_output=True,text=True,timeout=10)
- assert version.returncode==0 and version.stdout.strip().split()[0] in ('2.1.309','2.1.310'),(version.returncode,version.stdout)
+ assert version.returncode==0 and version.stdout.strip().split()[0] in ('2.1.309','2.1.310','2.1.314'),(version.returncode,version.stdout)
  label=version.stdout.strip().split()[0]; digest=sha(binary)
  for mode in ('context','normalized'):
   d=ROOT/(label+'-'+mode); d.mkdir(); home=d/'home';home.mkdir(); work=d/"work 'quoted'";work.mkdir();(work/'sub').mkdir()

package/docs/verified.json

@@ -2,7 +2,7 @@
   "schemaVersion": 1,
   "documents": {
     "README.md": {
-      "verifiedAgainst": "cb942e06d89c6cd9fbe81a3f6d36f3f1d1c14c14",
+      "verifiedAgainst": "5b63fa3809f5bee0002d01685abac8b2fadc0cdd",
       "paths": [
         "package.json",
         "src/",
@@ -11,14 +11,14 @@
       ]
     },
     "docs/security.md": {
-      "verifiedAgainst": "cb942e06d89c6cd9fbe81a3f6d36f3f1d1c14c14",
+      "verifiedAgainst": "5b63fa3809f5bee0002d01685abac8b2fadc0cdd",
       "paths": [
         "src/",
         "templates/"
       ]
     },
     "docs/operations.md": {
-      "verifiedAgainst": "cb942e06d89c6cd9fbe81a3f6d36f3f1d1c14c14",
+      "verifiedAgainst": "5b63fa3809f5bee0002d01685abac8b2fadc0cdd",
       "paths": [
         "package.json",
         "src/",
@@ -35,7 +35,7 @@
       ]
     },
     "docs/quickstart.md": {
-      "verifiedAgainst": "cb942e06d89c6cd9fbe81a3f6d36f3f1d1c14c14",
+      "verifiedAgainst": "5b63fa3809f5bee0002d01685abac8b2fadc0cdd",
       "paths": [
         "package.json",
         "src/",
@@ -43,7 +43,7 @@
       ]
     },
     "docs/agent-notes/adapters.md": {
-      "verifiedAgainst": "cb942e06d89c6cd9fbe81a3f6d36f3f1d1c14c14",
+      "verifiedAgainst": "5b63fa3809f5bee0002d01685abac8b2fadc0cdd",
       "paths": [
         "src/adapters/",
         "src/pi/",
@@ -81,7 +81,7 @@
       ]
     },
     "docs/agent-notes/benchmarks.md": {
-      "verifiedAgainst": "43867c65caaadc8d7bdc44e034ecf1b933c8df77",
+      "verifiedAgainst": "ce8da3ec141f7ef17e2e1cd6a8104ddc36304efe",
       "paths": [
         "scripts/benchmarks/",
         "test/benchmarks/",
@@ -93,7 +93,7 @@
       ]
     },
     "docs/agent-notes/budget.md": {
-      "verifiedAgainst": "cb942e06d89c6cd9fbe81a3f6d36f3f1d1c14c14",
+      "verifiedAgainst": "ce8da3ec141f7ef17e2e1cd6a8104ddc36304efe",
       "paths": [
         "src/hub/budget.ts",
         "src/cli/statusline-tee.ts",
@@ -117,7 +117,7 @@
       ]
     },
     "docs/agent-notes/bus.md": {
-      "verifiedAgainst": "cb942e06d89c6cd9fbe81a3f6d36f3f1d1c14c14",
+      "verifiedAgainst": "ce8da3ec141f7ef17e2e1cd6a8104ddc36304efe",
       "paths": [
         "src/hub/bus.ts",
         "src/hub/envelope.ts",
@@ -132,7 +132,7 @@
       ]
     },
     "docs/agent-notes/daemon.md": {
-      "verifiedAgainst": "cb942e06d89c6cd9fbe81a3f6d36f3f1d1c14c14",
+      "verifiedAgainst": "ce8da3ec141f7ef17e2e1cd6a8104ddc36304efe",
       "paths": [
         "src/hub/daemon.ts",
         "src/hub/control-client.ts",
@@ -205,7 +205,7 @@
       ]
     },
     "docs/agent-notes/local-worker.md": {
-      "verifiedAgainst": "aeeaeb048860316dd4e08d84a658519ed6c0ad24",
+      "verifiedAgainst": "ce8da3ec141f7ef17e2e1cd6a8104ddc36304efe",
       "paths": [
         "src/adapters/local-worker.ts",
         "src/local/",
@@ -217,7 +217,7 @@
       ]
     },
     "docs/agent-notes/models.md": {
-      "verifiedAgainst": "aeeaeb048860316dd4e08d84a658519ed6c0ad24",
+      "verifiedAgainst": "ce8da3ec141f7ef17e2e1cd6a8104ddc36304efe",
       "paths": [
         "src/models/",
         "src/hub/inference.ts",
@@ -225,7 +225,7 @@
       ]
     },
     "docs/agent-notes/tasks.md": {
-      "verifiedAgainst": "cb942e06d89c6cd9fbe81a3f6d36f3f1d1c14c14",
+      "verifiedAgainst": "ce8da3ec141f7ef17e2e1cd6a8104ddc36304efe",
       "paths": [
         "src/hub/tasks.ts",
         "src/hub/board.ts",
@@ -264,7 +264,7 @@
       ]
     },
     "docs/agent-notes/tests.md": {
-      "verifiedAgainst": "cb942e06d89c6cd9fbe81a3f6d36f3f1d1c14c14",
+      "verifiedAgainst": "5b63fa3809f5bee0002d01685abac8b2fadc0cdd",
       "paths": [
         "test/",
         "scripts/check.sh",
@@ -292,7 +292,7 @@
       ]
     },
     "docs/agent-notes/README.md": {
-      "verifiedAgainst": "cb942e06d89c6cd9fbe81a3f6d36f3f1d1c14c14",
+      "verifiedAgainst": "ce8da3ec141f7ef17e2e1cd6a8104ddc36304efe",
       "paths": [
         "src/cli/console-state.ts",
         "src/cli/attention.ts",
@@ -301,7 +301,7 @@
       ]
     },
     "src/cli/help.ts": {
-      "verifiedAgainst": "cb942e06d89c6cd9fbe81a3f6d36f3f1d1c14c14",
+      "verifiedAgainst": "ce8da3ec141f7ef17e2e1cd6a8104ddc36304efe",
       "paths": [
         "src/cli/main.ts",
         "src/cli/launch.ts",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@staix/agent-hub",
-  "version": "0.22.0",
+  "version": "0.23.1",
   "description": "Native multi-agent hub: Claude Code, Codex, Kimi Code, Pi and local inference as peers in one project",
   "license": "MIT",
   "type": "module",
@@ -17,7 +17,7 @@
     "bun": ">=1.4.2"
   },
   "dependencies": {
-    "@staix/agent-mem": "0.13.0"
+    "@staix/agent-mem": "0.14.0"
   },
   "devDependencies": {
     "@modelcontextprotocol/sdk": "^1.27.1",