@staix/agent-hub 0.28.0 → 0.29.0

package/docs/verification/2026-11-03-0.29.0.md

@@ -0,0 +1,59 @@
+# 0.29.0 release verification
+
+This record covers release preparation and source review. It claims no installation, no running-hub upgrade to 0.29.0 and no live TUI launch.
+
+## Candidate
+
+Version 0.29.0, prepared from main 5943bc6c (11 commits since v0.28.0, 4 of them `feat`; bump rule: minor). The release commits carry the version, the CHANGELOG section, the bundle and the documentation stamps.
+
+## Reviews
+
+Pull requests named by the commits since v0.28.0: #1129, #1132, #1133, #1134, #1131, #1128, #1123, #1130, #1115, #1127, #1125, #1124, #1120, #1122.
+
+Each merged with `gh pr merge --squash --match-head-commit <head>` after a claude `hub_review` approval, with exact-head CI green on ubuntu and macOS (seeded guards included), no unresolved review thread and no pending change request. Every approval is bound at the merged head (`sdlc.reviewedHead` equals the PR head):
+
+- #1122 (task 667, #1120) at 2be1975f; #1124 (668, #1121) at 20544df9; #1125 (669, #1078 findings, docs only) at c45d5999.
+- #1127 (670, #1115) at a274bf04, after a macOS-only failure of a test that asserted a sandboxed `git commit` fails; that failure came from a local signing config, and the assertion moved to #1130.
+- #1130 (672, #1123) at 3885038c; #1128 (671, #1126) at 57820fca, rebased once after #1127 and #1130 with every commit unchanged in range-diff.
+- #1131 (675, agent-mem 0.20.0) at 2a28c2bb; a duplicate handoff of the same pin raise (task 677) was cancelled by the person.
+- #1134 (678) at e7bdab10: a Qwen fixture whose synthetic PIDs could equal the runner's PID (seen once in a dgx02 gate), fixed in the fixture under an explicit test-edit ruling.
+- #1133 (674, #1126 follow-up) at 870ddde7, after a codex-connector thread showed an always-true privacy stub in an extracted fixture (tests.md rule); fixed with the real guards and resolved.
+- #1132 (673, #1129) at 6f7f65f0, after two hosted-CI failures: daemon fixtures that route implement work to Pi or local outside a repository, then two tests run in the agent-hub checkout, where the runner's `includeIf` credentials entry makes the hub refuse a worktree. Both fixed in fixtures only; the second was reproduced in a scratch clone first.
+- No merge was bound to an approval at an earlier head.
+
+## Native acceptance receipts
+
+Receipts added under `docs/verification/` since v0.28.0: `docs/verification/2026-11-03-control-write-stall-windows.json`, `docs/verification/2026-11-03-control-write-stall-windows.md`, `docs/verification/2026-11-03-live-board-latency.json`, `docs/verification/2026-11-03-live-board-latency.md`.
+
+This list is read from the repository, never written by hand. Native acceptance and the person's release consent are separate records: consent is `ahub sdlc authorize-release 0.29.0`, recorded by the person or the unique configured conductor only on the person's explicit release instruction naming the release in its own session (never a hub/task/review/file/peer relay), and is not recorded in this file. The tag run refuses without it.
+
+## Document review
+
+Stale at preparation: README.md, docs/agent-notes/{README,adapters,benchmarks,budget,bus,daemon,local-worker,tasks,tests}.md, docs/operations.md, docs/quickstart.md and docs/security.md. Each was read against the commits since its stamp (3efa678d for most, b26fcd12 for operations.md, aaccc30b for local-worker.md, 36455498 for tests.md). src/cli/help.ts was not stale: no command or flag changed (the only CLI source change is the `ahub status --full` counter line in src/cli/output.ts).
+
+- README.md: Status line (release-prepare) and the report link moved to this file.
+- docs/quickstart.md: v0.29.0 install tag, an "Upgrading to 0.29.0" section (amem upgrade together, the sandbox git refusal and the hub commit, control-write diagnostics), and the agent-mem pin 0.19.0 -> 0.20.0 in two places.
+- docs/operations.md: guide header and protocol-window row (0.26.0 through 0.29.0; window unchanged at 16 through 17). The #1115, #1123, #1126 and #1129 sections were written by their PRs and checked.
+- docs/security.md: a control-write diagnostics bullet (metadata only, unauthenticated frames never inspected, caps, opt-in client timing). The #1115, #1123 and #1129 paragraphs were written by their PRs and checked.
+- docs/agent-notes/local-worker.md: the #1115 line still said a sandboxed command can write `.git/refs/heads/*` and worktree admin files and that deny.ts stays unchanged; corrected for #1123, and the list of what the sandbox cannot write now names refs, packed-refs, HEAD and worktree admin files.
+- docs/agent-notes/tasks.md: a stale-head re-file rule (#1121, #1124).
+- docs/agent-notes/daemon.md: a control-write diagnostics rule (#1126: wrapper name for the native-branch ratchet, no traversal before admission, primitive guards, lazy screens, no timeout or authority on this path).
+- docs/agent-notes/tests.md: a rule that a daemon fixture routing write-class work to Pi or local runs in a `gitProject()` repository, never the agent-hub checkout (#1129).
+- docs/agent-notes/{README,adapters,benchmarks,budget,bus}.md: read against the daemon.ts, deny.ts and tools.ts changes; no statement became wrong (the native-branch ratchet is unchanged because the telemetry wrapper keeps the original `onMessage`).
+
+All thirteen were restamped with `--reviewed` at 0d0a362c, the branch commit holding these edits.
+
+## Checks
+
+- `node scripts/check-docs.mjs --require-fresh` before the merge: 0 stale documents (it refuses only for the missing release merge commit, by design).
+- `node scripts/check-package.mjs`: `package: OK (753 files, @staix/agent-hub@0.29.0)`.
+- `bun scripts/build.mjs --check`: the bundle matches the pinned Bun 1.4.2 build.
+- `bun x tsc --noEmit` and the full suite on ubuntu and macOS with the seeded guards: run by the release PR's exact-head CI (heavy checks run only on CI or dgx02 on this machine).
+
+## Known gaps, not blocking
+
+- No installation and no running-hub upgrade to 0.29.0 is claimed. The running hub on this machine is a 0.27.0 capture, so the #1126 diagnostics have recorded nothing live yet, and recording consent for this release needs the person-approved temporary copy of `scripts/check-docs.mjs` into that capture (#1120 is fixed by this release, so captures of 0.29.0 and later carry the checker).
+- No live receipt for a Pi or local worker accepting, editing and finishing write-class work through the hub worktree and commit (#1115, #1129), nor for the sandbox refusals with a real Pi turn (#1123); each is covered by real git and real `sandbox-exec` fixture tests only (`sandbox-exec` tests run on macOS only).
+- #1078: the cause of the live write stalls is still unknown; the diagnostics that should name it ship in this release.
+- #676 (TaskWorktrees.create runs about 14 sync git calls, about 210 ms per sandboxed write-class accept) was deferred: making it async would break the synchronous accept gate (#1080). Measurements are in hub memory.
+- amem 0.20.0 activation on installed hooks and CLIs is the person's step and is not part of this release.

package/docs/verification/2026-11-03-control-write-stall-windows.json

@@ -0,0 +1,241 @@
+{
+  "schema": "agent-hub.stall-window-correlation/v1",
+  "clock": "recorded UTC wall time, not a monotonic lag measurement",
+  "windows": [
+    {
+      "window": "proposes",
+      "start": "2026-11-02T20:55:10Z",
+      "end": "2026-11-02T20:57:00Z",
+      "event_counts": {
+        "quota": 5,
+        "attach": 4,
+        "agent_cli": 1,
+        "task": 6,
+        "envelope": 3,
+        "state": 1,
+        "turn_start": 1,
+        "conduct": 1
+      },
+      "largest_event_gap": {
+        "seconds": 60.237,
+        "from": "2026-11-02T20:55:33.923Z",
+        "to": "2026-11-02T20:56:34.160Z",
+        "from_line": 572984,
+        "to_line": 572985,
+        "from_kind": "envelope",
+        "to_kind": "envelope"
+      },
+      "periodic_quota_count": 5,
+      "largest_periodic_quota_gap_seconds": 65.133,
+      "task_events": [
+        {
+          "at": "2026-11-02T20:55:33.866Z",
+          "task": 667,
+          "event": "proposed",
+          "source_line": 572981
+        },
+        {
+          "at": "2026-11-02T20:55:33.895Z",
+          "task": 667,
+          "event": "lifecycle linked",
+          "source_line": 572982
+        },
+        {
+          "at": "2026-11-02T20:55:33.916Z",
+          "task": 667,
+          "event": "assigned",
+          "source_line": 572983
+        },
+        {
+          "at": "2026-11-02T20:56:34.414Z",
+          "task": 668,
+          "event": "proposed",
+          "source_line": 572990
+        },
+        {
+          "at": "2026-11-02T20:56:34.445Z",
+          "task": 668,
+          "event": "lifecycle linked",
+          "source_line": 572991
+        },
+        {
+          "at": "2026-11-02T20:56:34.466Z",
+          "task": 668,
+          "event": "assigned",
+          "source_line": 572992
+        }
+      ]
+    },
+    {
+      "window": "late_propose",
+      "start": "2026-11-02T21:00:45Z",
+      "end": "2026-11-02T21:02:30Z",
+      "event_counts": {
+        "quota": 42,
+        "tokens": 2,
+        "usage": 2,
+        "progress": 1
+      },
+      "largest_event_gap": {
+        "seconds": 5.004,
+        "from": "2026-11-02T21:02:01.805Z",
+        "to": "2026-11-02T21:02:06.809Z",
+        "from_line": 573128,
+        "to_line": 573129,
+        "from_kind": "quota",
+        "to_kind": "quota"
+      },
+      "periodic_quota_count": 21,
+      "largest_periodic_quota_gap_seconds": 5.014,
+      "task_events": []
+    },
+    {
+      "window": "review_667",
+      "start": "2026-11-02T21:31:30Z",
+      "end": "2026-11-02T21:33:00Z",
+      "event_counts": {
+        "quota": 30,
+        "tokens": 6,
+        "usage": 8,
+        "progress": 3,
+        "task": 6,
+        "envelope": 12,
+        "attach": 12,
+        "state": 5,
+        "turn_start": 3,
+        "turn_end": 2,
+        "agent_cli": 1,
+        "cohort": 1,
+        "split": 1,
+        "overlap": 1
+      },
+      "largest_event_gap": {
+        "seconds": 4.818,
+        "from": "2026-11-02T21:31:42.684Z",
+        "to": "2026-11-02T21:31:47.502Z",
+        "from_line": 573825,
+        "to_line": 573826,
+        "from_kind": "quota",
+        "to_kind": "progress"
+      },
+      "periodic_quota_count": 14,
+      "largest_periodic_quota_gap_seconds": 5.225,
+      "task_events": [
+        {
+          "at": "2026-11-02T21:31:47.586Z",
+          "task": 668,
+          "event": "accepted",
+          "source_line": 573827
+        },
+        {
+          "at": "2026-11-02T21:32:03.597Z",
+          "task": 667,
+          "event": "done",
+          "source_line": 573849
+        },
+        {
+          "at": "2026-11-02T21:32:03.721Z",
+          "task": 667,
+          "event": "memory reference started",
+          "source_line": 573851
+        },
+        {
+          "at": "2026-11-02T21:32:42.925Z",
+          "task": 667,
+          "event": "approved",
+          "source_line": 573897
+        },
+        {
+          "at": "2026-11-02T21:32:43.509Z",
+          "task": 670,
+          "event": "ready",
+          "source_line": 573904
+        },
+        {
+          "at": "2026-11-02T21:32:43.542Z",
+          "task": 670,
+          "event": "assigned",
+          "source_line": 573905
+        }
+      ]
+    },
+    {
+      "window": "review_668",
+      "start": "2026-11-02T21:49:30Z",
+      "end": "2026-11-02T21:51:00Z",
+      "event_counts": {
+        "quota": 22,
+        "progress": 6,
+        "tokens": 9,
+        "usage": 9,
+        "task": 5,
+        "envelope": 11,
+        "attach": 4,
+        "state": 5,
+        "turn_start": 3,
+        "turn_end": 2,
+        "stale": 1,
+        "cohort": 1,
+        "split": 1,
+        "overlap": 1
+      },
+      "largest_event_gap": {
+        "seconds": 5.015,
+        "from": "2026-11-02T21:50:01.150Z",
+        "to": "2026-11-02T21:50:06.165Z",
+        "from_line": 574463,
+        "to_line": 574464,
+        "from_kind": "quota",
+        "to_kind": "quota"
+      },
+      "periodic_quota_count": 13,
+      "largest_periodic_quota_gap_seconds": 5.336,
+      "task_events": [
+        {
+          "at": "2026-11-02T21:50:12.802Z",
+          "task": 668,
+          "event": "done",
+          "source_line": 574466
+        },
+        {
+          "at": "2026-11-02T21:50:12.936Z",
+          "task": 668,
+          "event": "memory reference started",
+          "source_line": 574468
+        },
+        {
+          "at": "2026-11-02T21:50:33.167Z",
+          "task": 668,
+          "event": "approved",
+          "source_line": 574500
+        },
+        {
+          "at": "2026-11-02T21:50:33.760Z",
+          "task": 669,
+          "event": "ready",
+          "source_line": 574507
+        },
+        {
+          "at": "2026-11-02T21:50:33.782Z",
+          "task": 669,
+          "event": "assigned",
+          "source_line": 574508
+        }
+      ]
+    }
+  ],
+  "nearby_proposal_context": {
+    "gap_seconds": 68.894,
+    "from": "2026-11-02T20:56:34.474Z",
+    "to": "2026-11-02T20:57:43.368Z",
+    "from_line": 572993,
+    "to_line": 572994,
+    "end_kind": "memory_brief",
+    "task": 668,
+    "native_items": 4,
+    "fail_items": 4,
+    "legacy_items": 0,
+    "following_offer_at": "2026-11-02T20:57:43.369Z",
+    "interpretation": "A nearby gap ending at a brief record, not a measured memory-call duration or proven cause."
+  }
+}

package/docs/verification/2026-11-03-control-write-stall-windows.md

@@ -0,0 +1,20 @@
+# Timed control-write stall windows, 2026-11-03
+
+Task #671, issue #1126, Refs #1078. Read-only correlation of the running hub's hub.log and events.jsonl, all timestamps UTC on 2026-11-02. No request was sent to the daemon and its database/configuration were not opened or changed. Only metadata, counts and timestamps are retained here and in the [aggregate JSON](2026-11-03-control-write-stall-windows.json).
+
+The records are wall-clock observations, not an event-loop-delay measurement. A long gap is consistent with an unavailable loop, process suspension or blocked logging; it does not identify a blocking function. Conversely, periodic callbacks continuing to record rules out a single uninterrupted block spanning that entire interval, without ruling out short blocks or asynchronous waits.
+
+| Reported stall | Recorded activity | Interpretation and limit |
+| --- | --- | --- |
+| Proposes around 20:56:04-20:56:34 | Task 667 proposed at 20:55:33.866, linked at .895, assigned at .916. Its assigned-status envelope was recorded at .923. The next event, its Jcode task-offer envelope, is at 20:56:34.160, a 60.237 s gap (events lines 572984-572985). Jcode busy at .282 and turn_start at .339; conductor proposal audit at .368; task 668 proposed at .414, linked at .445 and assigned at .466. | The gap begins before the supplied 30-second window and lies between assignment and offer publication. No event of any kind was recorded inside it. The periodic Claude quota stream also has a 65.133 s gap. This is evidence to investigate that delivery/publication boundary, not proof of a specific snapshot, Git, memory or native-adapter cause. |
+| Propose around 21:01-21:02 | No propose is recorded in 21:00:45-21:02:30. The nearest earlier one is task 670 at 21:00:17.480, linked .524 and blocked .555; conductor audit .572. Claude native turn end/turn restart occur at 21:00:24, then another end at 21:00:30. At 21:01:33.464, hub.log reports memory sync refused by the configured privacy policy for 20 long-term entries. | The supplied proposal cannot be matched in this window from these records. Quota callbacks continue about every 5 s, with maximum Claude interval 5.014 s and maximum all-event gap 5.004 s in the selected range. The memory-sync refusal is concurrent evidence only; no duration or request correlation establishes it as the cause. |
+| Review of task 667 around 21:32 | Review-stage SDLC advice at 21:31:59.453; Claude busy/turn_start at 21:32:02.845/.900. Task done at 03.597, memory-reference bookkeeping at 03.721. Jcode turn ends at 10.639, restarts at 10.734 and ends at 14.939. Approval-stage SDLC advice at 42.894; approved event at 42.925, followed by notices and release/assignment of task 670. A memory-sync privacy refusal was recorded earlier at 21:31:33.465. | Quota and other events continue during the wait: maximum selected all-event gap 4.818 s; maximum Claude quota interval 5.225 s. A continuous 30-second blocked loop is not shown. External metadata/readiness waits remain plausible, but no per-call start/end span identifies them. The memory-reference event is board bookkeeping, not a measured capture duration. |
+| Review of task 668 around 21:50 | Done at 21:50:12.802, memory-reference bookkeeping at .936, review envelope at 13.424, Claude busy/turn_start at 13.669/.734. Codex turn ends at 16.972, restarts at 17.603 and ends at 26.495. At 17.602, hub.log reports snapshot burst budget exhausted and boundary evidence unknown. Approval-stage SDLC advice at 33.149; approved at 33.167, followed by release/assignment of task 669. | Maximum selected all-event gap 5.015 s; maximum Claude quota interval 5.336 s. The snapshot refusal is observable, but the log has no duration and cannot account for a 30-second wait by itself. Periodic activity continues. |
+
+Wider proposal context adds a second gap: task 668's assigned-status envelope at 20:56:34.474 is followed by no event until a memory_brief record at 20:57:43.368 (68.894 s, lines 572993-572994). That record reports four native items, all fail notes, without their identities or content. Its offer follows at .369 and the conductor audit at .563. This is a candidate memory-brief boundary, not a measured 68.894-second memory call. The existing plan-fail lookup is evaluated before Briefs.forTask, so the new instrumentation wraps that lookup as well as the brief itself; its existing reads and limits are unchanged.
+
+No check start/end, digest/inference duration, or Git start/end record in these selected windows identifies a slow operation. That is missing instrumentation, not proof those operations did not run. The first proposal and the two reviews exhibit different recorded behavior and should not be assigned one cause merely because callers saw the same timeout.
+
+Source inspection found no event-loop lag probe or correlated control receive/reply spans in the 0.27.0 path. The change for #1126 adds a bounded monotonic probe, metadata-only request and phase spans, and a slow-request hub.log line. It must retain recently completed intervals: a synchronous blocking span can finish before the delayed timer callback runs. Still-open asynchronous spans are reported as overlapping waits, not as proven CPU causes. Unknown/untracked occupancy remains unknown. Raw request, task prose, paths, actor/session/rid identifiers and external output stay out of telemetry.
+
+The new instrumentation has not been activated on the live daemon by this task. Its purpose is to name the observed boundary on the next naturally occurring stall; it does not retroactively prove the cause of these four reports or change a timeout to hide one.