@staix/agent-hub 0.28.0 → 0.30.0

package/docs/verification/2026-11-03-agy-1.4.12.md

@@ -0,0 +1,90 @@
+# Antigravity 1.4.12 account-free T0 re-run
+
+Date: 2026-11-03. Task #681, Refs #485. This repeats the account-free CLI, print/plugin/hook and interactive-close legs of the [1.4.7 receipt](2026-10-26-agy-1.4.7.md) against the installed 1.4.12.
+
+**Decision: do not add 1.4.12 to `verified`.** CLI surface, the synthetic MCP/native-read hook contract and normal TUI close passed. The current-bundle actual-hub nonce leg did not pass. `src/adapters/compat.ts`, `test/agy-compat-receipt.test.ts` and the smoke version line remain unchanged. This receipt does not establish that the failed leg is an agy regression; the host/bundle and producer setup also changed since the 1.4.7 run.
+
+## Isolation and exact executable
+
+- Native version: `1.4.12`, exit 0. Executable: the installed `~/.local/bin/agy`, SHA-256 `34423fc9b0af3841e7646aa72a2d40ffeab8218b22d1cb99eac7355f9eba31e3`. Its bytes matched before the first invocation, after each producer and after the last invocation. The person's decision was to retain this installed version; no install, update or downgrade was performed.
+- Host: macOS 27.0.1 arm64; native producer/interpreter: Bun 1.4.3. Source and committed bundle: `a51c8fc708eda19cc57c20b1084b3978c2ec5d54`, agent-hub 0.29.0. A local `dot admit`-admitted `bun install --frozen-lockfile` preceded the probes; the installed `@staix/agent-mem` version was asserted equal to the exact 0.20.1 manifest pin.
+- Every agy invocation set `AGY_CLI_DISABLE_AUTO_UPDATE=1`, including CLI surface and `mcp list`, print mode and TUI. Each producer had a fresh controller HOME and each native run a fresh HOME/tool-home/project/temp tree, all under `getconf DARWIN_USER_TEMP_DIR`. No credentials or native settings were copied from the real home.
+- Each native child used the `profile()` implementation from `src/local/sandbox.ts`, followed by an explicit real-home read/write deny. Narrow read/execute exceptions covered only the native executable, Bun and the committed bundle directory. Write grants covered only the scratch paths. Egress was limited to the loopback provider fixture and, for actual-hub runs, the scratch daemon's control port. This is the probe's sandbox, not a claim about ordinary native agy confinement.
+- An explicit controller environment replaced inherited agent markers. `AGENTHUB_HOME`, `AMEM_HOME`, `AGENTHUB_STATE_DIR` and `AGENTHUB_PROJECT_DIR` named scratch locations before hub modules loaded; every native child also had explicit scratch hub paths. The shell's live-hub locations were never used. Scratch daemons had memory/native capture, inference/triage, snapshots, MLX, Pi auto-start and design specs disabled, with agy roster admission enabled.
+- Isolation checks opened the real Gemini settings file read-only and attempted an `O_WRONLY` open of the native binary, without `O_TRUNC` or any write. Both were denied with `Operation not permitted`. Thus even an unexpected write-open guard failure could not have changed binary bytes.
+- The five named real Gemini config entries below matched before and after. Every completed producer removed its native temporary root; both scratch daemons stopped. A fresh final process-table inspection found no remaining native/probe process from this series.
+
+## Producer copies and setup corrections
+
+The three originals under `scratchpad/temp/agent-hub-267/` were hashed before copying and again after the series; all were unchanged. Only new copies under `scratchpad/temp/agent-hub-681/` were adapted:
+
+- `actual-hub-adapted.ts`: current worktree/Bun/bundle paths, disabled updater, explicit scratch hub paths, disabled unrelated daemon features, captured hook rows.
+- `native-hooks-adapted.ts`: current paths and isolation above; hooks moved in the copy from the older project-level `.agents/hooks.json` location to the fixture plugin's `.agents/plugins/agent-hub/hooks.json`. The MCP server remained a synthetic stand-in, never this project's hub.
+- `tui-actual.ts`: current paths/isolation, two prompt steps and a normal `/exit` plus Enter close. The copied harness recorded `signalFallbackNeeded` separately; only a still-running child could receive a fallback signal.
+- The CLI surface helper reused the copied actual-hub producer's profile and bounded child cleanup. One initial setup observation used Bun's `userInfo().homedir` under the isolated HOME, which named the scratch home rather than the real home. It was discarded as real-home guard evidence. All copies then pinned the controller's actual real-home path in the deny/hash inventory; the corrected CLI guards above tested the actual real files.
+
+No source, timeout ceiling, native approval rule or product identity guard was changed to make a native leg pass. The CLI/print child bound remained 25 seconds. `/exit` was given its bounded normal-close window, with fallback recorded rather than counted as a pass.
+
+## CLI surface
+
+| Probe | Observation |
+| --- | --- |
+| `--version` | `1.4.12`, exit 0 |
+| `--help` and `help` | Exit 0; flags the launcher uses/refuses are still present, including `--continue`, `--conversation`, `--disable-slash-commands`, `--input-format`, `--output-format`, `--print`, `--prompt-interactive`, `--project`, `--remote-control` and `--sandbox` |
+| `--acp` | Exit 2, `flags provided but not defined: -acp` |
+| `--new` | Exit 2, `flags provided but not defined: -new` |
+| Subcommands | `agent`, `agents`, `changelog`, `help`, `install`, `mcp`, `mic-serve`, `models`, `plugin`, `plugins`, `remote-control`, `update`; no ACP subcommand |
+| Workspace-plugin `mcp list` | Exit 0, `No MCP servers configured.`, while the subsequent synthetic fixture run successfully discovered and called the plugin's tools |
+
+## Synthetic plugin MCP and hook contract: passed
+
+The print-mode loopback Gemini fixture replayed two MCP calls and a native read. No real account or cloud model turn was used. The MCP server returned fixture text only; its `hub_review` response was not a board review or approval.
+
+- Native process exit 0, empty stderr. Plugin-local discovery recorded `server/discover`, `initialize`, `notifications/initialized`, `tools/list`, `tools/call`, `tools/call`.
+- The two calls were `hub_task_show` with `id: 1` and `hub_review` with fixture-only arguments. Native `call_mcp_tool` retained `ServerName`, `ToolName` and `Arguments`; no `toolSummary`/`toolAction` was supplied.
+- The native read remained `read_file` with `Path`, `StartLine` and `EndLine`, reading the scratch canary. No decoder change was made.
+- All six plugin-local phases fired: `SessionStart`, `PreInvocation`, `PreToolUse`, `PostToolUse`, `PostInvocation`, `Stop`. Tool phases used `matcher: ".*"` with a nested hooks array.
+- Shared hook stdin fields remained `artifactDirectoryPath`, `conversationId`, `lastUserInput`, `modelName`, `transcriptPath`, `workspacePaths`. Invocation phases added `initialNumSteps` and `invocationNum`; tool phases included `stepIdx` and `toolCall: {name, args}`, with an empty `error` on successful post-tool events.
+- `Stop` reported `executionNum: 0`, `terminationReason: NO_TOOL_CALL`, empty `error`, and `fullyIdle: true`. The fixture's `SessionStart`/`PreInvocation` `injectSteps` ephemeral messages were accepted.
+- Init listed 60 tools and `permission_mode: request-review`. The provider-facing declaration set remained the same 15 as 1.4.7: `ask_question`, `call_mcp_tool`, `define_subagent`, `edit_file`, `invoke_subagent`, `list_resources`, `manage_subagents`, `manage_task`, `read_file`, `read_resource`, `run_command`, `schedule`, `search_web`, `send_message`, `write_file`.
+- Native output SHA-256: `be8d2db8393eea858058990ca90a7535c4440466d425a5f2b43d5c46a0fc9d81`. Real config inventory matched; the temporary root was removed.
+
+## Actual scratch-hub nonce readback: failed
+
+The actual-hub producer used the committed bundle and a nonce held only in the scratch bus preface. Its success criterion was delivery of that nonce into a later loopback provider request, not merely a native exit 0 or a tool declaration.
+
+| Attempt | Observed result |
+| --- | --- |
+| Original copied bundle argv (`bun run <bundle>`) | Exit 0, empty stderr, three provider requests, one `call_mcp_tool` for `agent-hub_agent-hub/hub_inbox`; all six hooks fired. The bundle joined as a distinct `agy~...` session, returned a notice that it was not the project's agy, and did not return the canonical agy preface. `nonceInModelRequest: false`. |
+| Explicit bundle-cwd variant (`bun --cwd <scratch-project> run <bundle>`) | Exit 0, empty stderr, two provider requests, zero MCP calls; only session/invocation/Stop hooks fired. `nonceInModelRequest: false`. |
+
+The explicit-cwd variant addressed the current channel-project contract's requirement that the bundle process run at the project root; it did not bypass that identity check or force a model call to an undeclared tool. It still did not establish nonce readback. The first attempt's native output SHA-256 was `ba584c0ca2d301570576ae12699cffa2b41150d340fa0f8670c9a39cc0979558`; the explicit-cwd variant's was `037da39333e4439f03d9acb09ed998ef725d225837c5ba32cabceed07d44256e`.
+
+These are recorded as failed acceptance evidence for this re-run. No claim is made that the identity notice or absent tool is caused by the 1.4.12 binary: this producer was originally written for an older hub, and the current bundle's project/session admission is another variable. No additional native retry was used to manufacture a green result.
+
+## Interactive TUI and normal close
+
+The explicit bundle-cwd variant was used for the interactive PTY, with fresh-HOME onboarding, then two prompts and `/exit` followed by Enter.
+
+- The native TUI exited on its own with code 0 and printed its resume command. `signalFallbackNeeded: false`; no signal was sent to close it. The scratch daemon stopped and the native temporary root was removed.
+- Provider declaration counts were 0, 12 and 12. Neither prompt exposed `call_mcp_tool`; MCP call count was zero and `nonceInModelRequest` was false. Only `SessionStart`, invocation phases and `Stop` were observed in this actual-bundle TUI run. Thus the normal-close sub-leg passed, while interactive actual-hub delivery did not.
+- PTY output SHA-256: `e096b2f2f84d665c4c4dc7be7b2408c585f9743a1f5839410a93040e4abf2945`.
+- This directly launches the native TUI in a disposable fixture. It does not verify `ahub agy`'s launch-slot release or managed-file cleanup, which belongs to the separate #443 receipt.
+
+## Real configuration inventory
+
+The controller hashed only the following named real `~/.gemini` files, without publishing their contents. The recorded digest/absence matched after every producer and at the end; this is not an inventory of every possible native file.
+
+| File | Before and after SHA-256/absence |
+| --- | --- |
+| `antigravity-cli/settings.json` | `bb14f0a81a8239c6b988873e63fdd4f55fd6c822dc695c5138e5253424df276d` |
+| `config/config.json` | `b8c51361bf83a00ae5e38b3108b48ffa3b4cfc7c4e9d9b7d16e04f74725f3c14` |
+| `config/mcp_config.json` | `d8e397af03b5b032f21d0aa967086f0c78b33c87b76f2e9898ae0a144df7de02` |
+| `config/import_manifest.json` | Absent |
+| Legacy `settings.json` | `66c879018049d90632634790fe0b0eae54616a144e594c5db1b40b7c8be8c7b9` |
+
+## Evidence boundary and follow-up
+
+The native print/hook fixture and normal close are established above; real-account behavior, a real model's tool choices, permission-prompt overrides, Stop continuation, IDE behavior and Linux native behavior remain unverified. Most importantly, actual-hub nonce delivery on the current bundle is not established. Diagnose the disposable producer's project identity/MCP startup path before another promotion attempt; preserve the real-home deny, updater-off environment, live-hub path override and nonce assertion.
+
+The changed repository gate runs on the committed receipt head via dgx02; its exact SHA and result are recorded in the PR/task submission. Hosted CI is a separate gate. This receipt leaves 1.4.12 as an unverified, in-line patch, with the accepted 1.4.x line and existing verified versions unchanged.

package/docs/verification/2026-11-03-agy-tui-close.md

@@ -0,0 +1,49 @@
+# Antigravity TUI close through `ahub agy` (#485)
+
+Date: 2026-11-03. Refs #485, task #443. This is the launcher leg the [1.4.7 receipt](2026-10-26-agy-1.4.7.md) left open: the hub's own `ahub agy` launch, the launch slot while the TUI runs, and what the launcher does when the TUI is closed normally. The earlier receipts closed agy by hand under a probe. This one runs the real `ahub agy` against a real scratch daemon.
+
+## Environment and isolation
+
+- Hub CLI and daemon: `ahub` 0.29.0, started with `ahub --live-test --project <scratch> up --no-agents --no-console` in a disposable Git project under the per-user temporary directory (outside the person's home). The scratch `status.json` named the scratch project root as `cwd`. The CLI's own `status` was refused for the agent identity, so that file was read instead. `jcode` was put on the scratch roster for a moment while diagnosing this and removed again. Memory and inference were off in the scratch config. `agy` was on that project's roster; no other peer was started.
+- Every command had `HOME`, `AGENTHUB_HOME`, `AGENTHUB_STATE_DIR`, `AGENTHUB_PROJECT_DIR`, `TMPDIR` and `XDG_CONFIG_HOME` set to scratch paths. The inherited agent markers were left in place, as the live-test procedure requires, and the launcher ran under `--live-test` delegation. The live hub of this repository was not contacted.
+- agy ran the interactive TUI on a PTY with `GEMINI_API_KEY=fixture-key` and `GOOGLE_GEMINI_BASE_URL` pointing at a loopback fixture provider (the 1.4.7 receipt's design: fixed `hub_inbox` call once the model lists `call_mcp_tool`, then a fixed text answer). No account and no cloud model call. Fresh-HOME onboarding was answered with the same keys (Enter, Down, Right, Enter, Enter). The scratch settings pre-allowed `mcp(agent-hub_agent-hub/hub_inbox)`.
+- **No Seatbelt was used around `ahub agy`** (the 1.4.7 receipt did use it). Isolation here rests on the scratch environment above and on the real-config hashes below.
+- Bystander files the launcher must not touch were placed in the scratch project: `.agents/plugins/other/plugin.json` and `.agents/rules/r.md`.
+- The person's real Gemini files were hashed before and after every run: `~/.gemini/antigravity-cli/settings.json`, `~/.gemini/config/config.json`, `~/.gemini/config/mcp_config.json`, `~/.gemini/settings.json` (and `config/import_manifest.json`, absent on this machine). Equal before and after in every run. The real `~/.gemini/antigravity-cli` directory did change during the window (new log files, `cli.log`, `conversation_summaries.db`, `builtin/`), and the real-config hashes are the evidence that my runs did not write there. The new entries are consistent with other agy processes on the machine: their logs show workspace `/` and the real app-data directory, while every agy run of this receipt logged the scratch project and the scratch app-data directory under its own HOME.
+
+## Facts (final run, agy 1.4.12; the same legs also passed in an earlier run, see below)
+
+| Leg | Observation |
+| --- | --- |
+| Slot is held during the launch, before agy attaches | `ahub agy` was started a second time seconds after the first, with the first still starting its TUI: exit 1, `a managed native launch is already active; end it in its terminal first`. The three managed files were still present. |
+| Slot is held while the TUI runs | After the first prompt was answered, a second `ahub agy`: exit 1, `native peer is already attached; end it in its terminal first`. The three managed files were still present. |
+| Launcher wrote the managed plugin | While the TUI ran, `.agents/plugins/agent-hub/` held exactly `hooks.json`, `mcp_config.json`, `plugin.json`. |
+| Hub tools worked through the plugin | The plugin MCP server attached lazily: provider requests listed 0, 12, then 15 tools (`call_mcp_tool` from the second agent request), `call_mcp_tool` ran `hub_inbox` once and the TUI printed the fixture answer. The hub log shows `agy` going `idle`, `busy`, `idle`. |
+| Normal close | `/exit` and Enter in the TUI: `agy` exited by itself, the `ahub agy` process exited 0, and agy printed its resume line. No signal was sent. The hub log shows `state agy -> offline`. |
+| Plugin cleanup | After the close `.agents/plugins/agent-hub/` was an empty directory: the three managed files were removed. |
+| Bystanders unchanged | SHA-256 of `.agents/plugins/other/plugin.json` and `.agents/rules/r.md` equal before and after. |
+| Slot is released | A second full launch right after the first close was admitted: three managed files written, TUI ran a prompt, `/exit` closed it with exit 0, the files were removed again, the bystanders were unchanged again. |
+| Real config | The five real-config hashes were equal before and after the run. |
+| Cleanup | `ahub --live-test --project <scratch> down` reported `hub stopped`. No `agy` process and no scratch hub process remained. |
+
+An earlier complete run (the first two-cycle run, agy 1.4.7 for the first cycle and 1.4.12 for the second, after the binary was replaced, see below) gave the same results for the held slot after attach, the normal close, the cleanup, the second admitted cycle, the bystanders and the real-config hashes.
+
+## Other observations
+
+- **Closing while a native approval is pending.** Two earlier runs typed `/exit` while the fixture's `hub_inbox` call was waiting on agy's native approval prompt (the scratch settings did not yet pre-allow it). agy did not exit within 15 s, the probe sent SIGTERM, `ahub agy` forwarded it, the slot was released and the managed files were removed. The next launch after that kill was admitted. Neither run is the normal-close leg above; they only show that the signal path also ends in a released slot and removed files.
+- The launcher printed `agy 1.4.12 is untested (verified 1.4.2, 1.4.7; compatible: the 1.4.x line); launching on the compatible line`, as designed (#589). `src/adapters/compat.ts` is unchanged by this receipt: 1.4.12 has no T0 receipt and stays unverified.
+
+## Side effect on the machine: agy replaced its own binary
+
+The first scratch run started agy 1.4.7 with a scratch HOME and without `AGY_CLI_DISABLE_AUTO_UPDATE`. agy spawned its background updater, which replaced the person's `~/.local/bin/agy` (a path the scratch HOME does not isolate) with 1.4.12 and kept the previous binary beside it as `agy.<n>.old`. The kept binary has SHA-256 `b7a13e53c9f49921692676ef8edc2e60ceb67064c00bc732d9a364ec3ad75b32`, the 1.4.7 hash recorded in the 1.4.7 receipt. The new binary's SHA-256 is `34423fc9b0af3841e7646aa72a2d40ffeab8218b22d1cb99eac7355f9eba31e3`. The real Gemini configuration files were not touched. Setting `AGY_CLI_DISABLE_AUTO_UPDATE=1` for any further live agy run prevents this; the smoke ledger now says so. Rolling back is the person's choice.
+
+## Not verified
+
+- A real account, a real model turn and agy's own permission prompts (the provider was a fixture).
+- `hub_send` and a board read or proposal through the TUI: only `hub_inbox` was called. AC3 of #485 names all three, so the issue stays open.
+- The IDE form, Linux, and a Seatbelt-wrapped `ahub agy`.
+- A launch of the verified 1.4.7 build from start to finish: the first cycle of the earlier run was 1.4.7 and the final run was 1.4.12.
+
+## Decision
+
+The hub launcher's own close leg holds on the 1.4.x line in a scratch project: the launch slot is held while agy starts and runs, a normal TUI close releases it so the next launch is admitted, the three managed plugin files are the only thing removed, and the person's real Gemini configuration hashes are unchanged. This does not close #485 on its own (see Not verified), so the pull request says `Refs #485`.

package/docs/verification/2026-11-03-control-write-stall-windows.json

@@ -0,0 +1,241 @@
+{
+  "schema": "agent-hub.stall-window-correlation/v1",
+  "clock": "recorded UTC wall time, not a monotonic lag measurement",
+  "windows": [
+    {
+      "window": "proposes",
+      "start": "2026-11-02T20:55:10Z",
+      "end": "2026-11-02T20:57:00Z",
+      "event_counts": {
+        "quota": 5,
+        "attach": 4,
+        "agent_cli": 1,
+        "task": 6,
+        "envelope": 3,
+        "state": 1,
+        "turn_start": 1,
+        "conduct": 1
+      },
+      "largest_event_gap": {
+        "seconds": 60.237,
+        "from": "2026-11-02T20:55:33.923Z",
+        "to": "2026-11-02T20:56:34.160Z",
+        "from_line": 572984,
+        "to_line": 572985,
+        "from_kind": "envelope",
+        "to_kind": "envelope"
+      },
+      "periodic_quota_count": 5,
+      "largest_periodic_quota_gap_seconds": 65.133,
+      "task_events": [
+        {
+          "at": "2026-11-02T20:55:33.866Z",
+          "task": 667,
+          "event": "proposed",
+          "source_line": 572981
+        },
+        {
+          "at": "2026-11-02T20:55:33.895Z",
+          "task": 667,
+          "event": "lifecycle linked",
+          "source_line": 572982
+        },
+        {
+          "at": "2026-11-02T20:55:33.916Z",
+          "task": 667,
+          "event": "assigned",
+          "source_line": 572983
+        },
+        {
+          "at": "2026-11-02T20:56:34.414Z",
+          "task": 668,
+          "event": "proposed",
+          "source_line": 572990
+        },
+        {
+          "at": "2026-11-02T20:56:34.445Z",
+          "task": 668,
+          "event": "lifecycle linked",
+          "source_line": 572991
+        },
+        {
+          "at": "2026-11-02T20:56:34.466Z",
+          "task": 668,
+          "event": "assigned",
+          "source_line": 572992
+        }
+      ]
+    },
+    {
+      "window": "late_propose",
+      "start": "2026-11-02T21:00:45Z",
+      "end": "2026-11-02T21:02:30Z",
+      "event_counts": {
+        "quota": 42,
+        "tokens": 2,
+        "usage": 2,
+        "progress": 1
+      },
+      "largest_event_gap": {
+        "seconds": 5.004,
+        "from": "2026-11-02T21:02:01.805Z",
+        "to": "2026-11-02T21:02:06.809Z",
+        "from_line": 573128,
+        "to_line": 573129,
+        "from_kind": "quota",
+        "to_kind": "quota"
+      },
+      "periodic_quota_count": 21,
+      "largest_periodic_quota_gap_seconds": 5.014,
+      "task_events": []
+    },
+    {
+      "window": "review_667",
+      "start": "2026-11-02T21:31:30Z",
+      "end": "2026-11-02T21:33:00Z",
+      "event_counts": {
+        "quota": 30,
+        "tokens": 6,
+        "usage": 8,
+        "progress": 3,
+        "task": 6,
+        "envelope": 12,
+        "attach": 12,
+        "state": 5,
+        "turn_start": 3,
+        "turn_end": 2,
+        "agent_cli": 1,
+        "cohort": 1,
+        "split": 1,
+        "overlap": 1
+      },
+      "largest_event_gap": {
+        "seconds": 4.818,
+        "from": "2026-11-02T21:31:42.684Z",
+        "to": "2026-11-02T21:31:47.502Z",
+        "from_line": 573825,
+        "to_line": 573826,
+        "from_kind": "quota",
+        "to_kind": "progress"
+      },
+      "periodic_quota_count": 14,
+      "largest_periodic_quota_gap_seconds": 5.225,
+      "task_events": [
+        {
+          "at": "2026-11-02T21:31:47.586Z",
+          "task": 668,
+          "event": "accepted",
+          "source_line": 573827
+        },
+        {
+          "at": "2026-11-02T21:32:03.597Z",
+          "task": 667,
+          "event": "done",
+          "source_line": 573849
+        },
+        {
+          "at": "2026-11-02T21:32:03.721Z",
+          "task": 667,
+          "event": "memory reference started",
+          "source_line": 573851
+        },
+        {
+          "at": "2026-11-02T21:32:42.925Z",
+          "task": 667,
+          "event": "approved",
+          "source_line": 573897
+        },
+        {
+          "at": "2026-11-02T21:32:43.509Z",
+          "task": 670,
+          "event": "ready",
+          "source_line": 573904
+        },
+        {
+          "at": "2026-11-02T21:32:43.542Z",
+          "task": 670,
+          "event": "assigned",
+          "source_line": 573905
+        }
+      ]
+    },
+    {
+      "window": "review_668",
+      "start": "2026-11-02T21:49:30Z",
+      "end": "2026-11-02T21:51:00Z",
+      "event_counts": {
+        "quota": 22,
+        "progress": 6,
+        "tokens": 9,
+        "usage": 9,
+        "task": 5,
+        "envelope": 11,
+        "attach": 4,
+        "state": 5,
+        "turn_start": 3,
+        "turn_end": 2,
+        "stale": 1,
+        "cohort": 1,
+        "split": 1,
+        "overlap": 1
+      },
+      "largest_event_gap": {
+        "seconds": 5.015,
+        "from": "2026-11-02T21:50:01.150Z",
+        "to": "2026-11-02T21:50:06.165Z",
+        "from_line": 574463,
+        "to_line": 574464,
+        "from_kind": "quota",
+        "to_kind": "quota"
+      },
+      "periodic_quota_count": 13,
+      "largest_periodic_quota_gap_seconds": 5.336,
+      "task_events": [
+        {
+          "at": "2026-11-02T21:50:12.802Z",
+          "task": 668,
+          "event": "done",
+          "source_line": 574466
+        },
+        {
+          "at": "2026-11-02T21:50:12.936Z",
+          "task": 668,
+          "event": "memory reference started",
+          "source_line": 574468
+        },
+        {
+          "at": "2026-11-02T21:50:33.167Z",
+          "task": 668,
+          "event": "approved",
+          "source_line": 574500
+        },
+        {
+          "at": "2026-11-02T21:50:33.760Z",
+          "task": 669,
+          "event": "ready",
+          "source_line": 574507
+        },
+        {
+          "at": "2026-11-02T21:50:33.782Z",
+          "task": 669,
+          "event": "assigned",
+          "source_line": 574508
+        }
+      ]
+    }
+  ],
+  "nearby_proposal_context": {
+    "gap_seconds": 68.894,
+    "from": "2026-11-02T20:56:34.474Z",
+    "to": "2026-11-02T20:57:43.368Z",
+    "from_line": 572993,
+    "to_line": 572994,
+    "end_kind": "memory_brief",
+    "task": 668,
+    "native_items": 4,
+    "fail_items": 4,
+    "legacy_items": 0,
+    "following_offer_at": "2026-11-02T20:57:43.369Z",
+    "interpretation": "A nearby gap ending at a brief record, not a measured memory-call duration or proven cause."
+  }
+}

package/docs/verification/2026-11-03-control-write-stall-windows.md

@@ -0,0 +1,20 @@
+# Timed control-write stall windows, 2026-11-03
+
+Task #671, issue #1126, Refs #1078. Read-only correlation of the running hub's hub.log and events.jsonl, all timestamps UTC on 2026-11-02. No request was sent to the daemon and its database/configuration were not opened or changed. Only metadata, counts and timestamps are retained here and in the [aggregate JSON](2026-11-03-control-write-stall-windows.json).
+
+The records are wall-clock observations, not an event-loop-delay measurement. A long gap is consistent with an unavailable loop, process suspension or blocked logging; it does not identify a blocking function. Conversely, periodic callbacks continuing to record rules out a single uninterrupted block spanning that entire interval, without ruling out short blocks or asynchronous waits.
+
+| Reported stall | Recorded activity | Interpretation and limit |
+| --- | --- | --- |
+| Proposes around 20:56:04-20:56:34 | Task 667 proposed at 20:55:33.866, linked at .895, assigned at .916. Its assigned-status envelope was recorded at .923. The next event, its Jcode task-offer envelope, is at 20:56:34.160, a 60.237 s gap (events lines 572984-572985). Jcode busy at .282 and turn_start at .339; conductor proposal audit at .368; task 668 proposed at .414, linked at .445 and assigned at .466. | The gap begins before the supplied 30-second window and lies between assignment and offer publication. No event of any kind was recorded inside it. The periodic Claude quota stream also has a 65.133 s gap. This is evidence to investigate that delivery/publication boundary, not proof of a specific snapshot, Git, memory or native-adapter cause. |
+| Propose around 21:01-21:02 | No propose is recorded in 21:00:45-21:02:30. The nearest earlier one is task 670 at 21:00:17.480, linked .524 and blocked .555; conductor audit .572. Claude native turn end/turn restart occur at 21:00:24, then another end at 21:00:30. At 21:01:33.464, hub.log reports memory sync refused by the configured privacy policy for 20 long-term entries. | The supplied proposal cannot be matched in this window from these records. Quota callbacks continue about every 5 s, with maximum Claude interval 5.014 s and maximum all-event gap 5.004 s in the selected range. The memory-sync refusal is concurrent evidence only; no duration or request correlation establishes it as the cause. |
+| Review of task 667 around 21:32 | Review-stage SDLC advice at 21:31:59.453; Claude busy/turn_start at 21:32:02.845/.900. Task done at 03.597, memory-reference bookkeeping at 03.721. Jcode turn ends at 10.639, restarts at 10.734 and ends at 14.939. Approval-stage SDLC advice at 42.894; approved event at 42.925, followed by notices and release/assignment of task 670. A memory-sync privacy refusal was recorded earlier at 21:31:33.465. | Quota and other events continue during the wait: maximum selected all-event gap 4.818 s; maximum Claude quota interval 5.225 s. A continuous 30-second blocked loop is not shown. External metadata/readiness waits remain plausible, but no per-call start/end span identifies them. The memory-reference event is board bookkeeping, not a measured capture duration. |
+| Review of task 668 around 21:50 | Done at 21:50:12.802, memory-reference bookkeeping at .936, review envelope at 13.424, Claude busy/turn_start at 13.669/.734. Codex turn ends at 16.972, restarts at 17.603 and ends at 26.495. At 17.602, hub.log reports snapshot burst budget exhausted and boundary evidence unknown. Approval-stage SDLC advice at 33.149; approved at 33.167, followed by release/assignment of task 669. | Maximum selected all-event gap 5.015 s; maximum Claude quota interval 5.336 s. The snapshot refusal is observable, but the log has no duration and cannot account for a 30-second wait by itself. Periodic activity continues. |
+
+Wider proposal context adds a second gap: task 668's assigned-status envelope at 20:56:34.474 is followed by no event until a memory_brief record at 20:57:43.368 (68.894 s, lines 572993-572994). That record reports four native items, all fail notes, without their identities or content. Its offer follows at .369 and the conductor audit at .563. This is a candidate memory-brief boundary, not a measured 68.894-second memory call. The existing plan-fail lookup is evaluated before Briefs.forTask, so the new instrumentation wraps that lookup as well as the brief itself; its existing reads and limits are unchanged.
+
+No check start/end, digest/inference duration, or Git start/end record in these selected windows identifies a slow operation. That is missing instrumentation, not proof those operations did not run. The first proposal and the two reviews exhibit different recorded behavior and should not be assigned one cause merely because callers saw the same timeout.
+
+Source inspection found no event-loop lag probe or correlated control receive/reply spans in the 0.27.0 path. The change for #1126 adds a bounded monotonic probe, metadata-only request and phase spans, and a slow-request hub.log line. It must retain recently completed intervals: a synchronous blocking span can finish before the delayed timer callback runs. Still-open asynchronous spans are reported as overlapping waits, not as proven CPU causes. Unknown/untracked occupancy remains unknown. Raw request, task prose, paths, actor/session/rid identifiers and external output stay out of telemetry.
+
+The new instrumentation has not been activated on the live daemon by this task. Its purpose is to name the observed boundary on the next naturally occurring stall; it does not retroactively prove the cause of these four reports or change a timeout to hide one.

package/docs/verification/2026-11-03-grok-1.0.62-t0.md

@@ -0,0 +1,150 @@
+# Grok 1.0.62 project MCP and hooks T0, 2026-11-03
+
+T0 receipt for #635, task #325. This probes the project-file TUI alternative to the [earlier ACP receipt](2026-10-21-grok-config-acp-t0.md). It does not establish launcher implementation, model-backed delivery, or native turn-end readiness.
+
+## Result
+
+| Leg | Result | Direct evidence |
+| --- | --- | --- |
+| Pinned native version | VERIFIED | `--version` exited 0: `grok 1.0.62 (1474f9cbdd91)` |
+| Project MCP configuration discovery | VERIFIED | `mcp list --json` reported `receipt`, `scope: project`, from `.grok/config.toml` |
+| Project MCP trust gate and connection | VERIFIED, synthetic server only | Untrusted doctor refused to start the server; after an isolated fixture trust grant, doctor initialized it and discovered one tool |
+| `search_tool` / `use_tool` to a hub tool | UNVERIFIED | Both credential-free `--single` attempts exited 1 with `Not signed in`; no `tools/call` was recorded |
+| Interactive trust prompt | UNVERIFIED | An untrusted PTY startup reached sign-in before any folder-trust prompt; authentication discovery could not proceed with network denied |
+| Hook configuration load | VERIFIED | Trusted `inspect --json` listed seven configured project event handlers, including `stop`; untrusted inspect listed none |
+| Hook firing and stdin payloads | UNVERIFIED | No credential-free model/session turn began, and the passive payload sink was never created |
+| Real configuration preservation | VERIFIED for nine named files | Before/after SHA-256 or absence matched for every entry listed below |
+
+Decision for the following launcher task: the pinned build recognizes a main-session `Stop` hook configuration, separately from `SubagentStop`. This is loader evidence, not evidence that a successful main turn fires it or that its payload is sufficient for hub facts/turn end. Keep the proposed peer pull-only unless a later isolated authenticated receipt proves main-turn completion and its payload. Do not infer hook absence from the account refusal, or turn-end support from configuration load alone. #635 stays open.
+
+## Isolation and preparation
+
+- Base checkout: `df230f2c89d0545c1a87cfd6bb8be57505a92c6c`. Branch: `test/635-grok-t0`; dedicated worktree `.worktrees/test-635-grok-t0`.
+- Before native probes, dgx02 ran `bun install --frozen-lockfile` at that base and asserted the installed first-party dependency against `package.json`: `@staix/agent-mem@0.20.1`. No repository runtime or inherited local `node_modules` was used by the native probes; the MCP fixture used only system Python.
+- The native executable was copied as one file from the installed Grok binary into a private OS-temporary root. Its SHA-256, before and after the probes, was `ec434e831afdcfce87780f2815fd732b1df8a4a8de96a491716ad75d13605a4e`.
+- Separate empty directories were supplied as `HOME`, `GROK_HOME`, `XDG_CONFIG_HOME`, `XDG_CACHE_HOME`, `XDG_DATA_HOME` and `TMPDIR`. A new throwaway Git project held the project MCP/hooks files; a second sibling project was used for the untrusted TUI probe.
+- The child environment was an explicit allowlist: those six directories, a scratch/system-only `PATH`, `SHELL=/bin/sh`, `TERM=xterm-256color`, `LANG=en_US.UTF-8`, `USER=probe`, `LOGNAME=probe` and `NO_COLOR=1`. No account variables, inherited agent markers or personal configuration were copied.
+- Every Grok invocation ran through macOS `sandbox-exec`, denying network, reads/writes under the person's real home, writes under `/etc` and `/Library`, and access to the securityd Mach service. Before the TUI probe, execution of `/usr/bin/open` and `/usr/bin/osascript` was also denied. These are probe controls, not a product sandbox claim.
+- Stateful commands explicitly passed `--no-leader --no-auto-update`. The subprocess harness bounded each command to 12 seconds, then signalled only its newly created process group. The PTY observation window was five seconds. No Grok process remained in the final fresh process-table read.
+- The first PTY capture harness had an EOF-drain bug after its native child exited: the Python harness stayed alive reading EOF. Only that identified probe-owned harness was terminated; EOF handling was corrected before the second capture. No native completion or teardown result is inferred from the discarded first capture.
+
+## Project MCP and trust
+
+The project's `.grok/config.toml` contained this self-contained fixture (`$PROBE_ROOT` below means the absolute temporary root substituted before writing TOML):
+
+```toml
+[mcp_servers.receipt]
+command = "/usr/bin/python3"
+args = ["$PROBE_ROOT/tools/mcp.py"]
+startup_timeout_sec = 3
+[mcp_servers.receipt.env]
+PROBE_LOG = "$PROBE_ROOT/evidence/mcp-events.jsonl"
+```
+
+The synthetic stdio MCP server answered `initialize` using the requested protocol version, declared a tools capability and `serverInfo` of `isolated-receipt-fixture` / `1.0.0`, and answered `tools/list` with one tool named `hub_inbox`. Its description and possible result explicitly said synthetic fixture. It was not a production hub, did not attach to this repository's running daemon and did not establish a real hub-tool result.
+
+Observed command sequence after fixture creation:
+
+```sh
+grok --no-leader --no-auto-update inspect --json
+grok --no-leader --no-auto-update mcp list --json
+grok --no-leader --no-auto-update mcp doctor receipt --json
+grok --no-leader --no-auto-update --trust inspect --json
+grok --no-leader --no-auto-update mcp doctor receipt --json
+```
+
+Every command above used the copied binary, isolated environment and sandbox wrapper. Before trust, inspect reported `projectTrusted: false` and `hooks: []`; MCP list still enumerated the project definition. Untrusted doctor exited 1 and reported:
+
+```text
+folder untrusted
+repo-local (project-scoped) server not started for an untrusted folder
+re-run with --trust to allow repo-local servers
+```
+
+The explicit `--trust` was a controlled grant to this disposable fixture, not launcher behavior or a grant to a real project. It persisted only in the isolated `$GROK_HOME/trusted_folders.toml`:
+
+```toml
+[folders."$PROBE_ROOT/project"]
+trusted = true
+```
+
+Afterward, trusted inspect reported `projectTrusted: true`. Doctor exited 0 with `command found`, `server started`, `handshake OK` (`protocol 2025-11-25`) and `1 tools discovered`; `healthy_count: 1`, `failing_count: 0`. The fixture recorded exactly:
+
+```text
+initialize
+notifications/initialized
+tools/list
+```
+
+Initialize's `clientInfo` was `grok-shell-receipt` / `1.0.62`. No `tools/call` occurred. A discovered tool is not proof of the model's meta-tool path.
+
+## Model/tool and interactive prompt limits
+
+Before and after the isolated trust grant, bounded single-turn commands requested the fixture hub tool. The trusted request was:
+
+```sh
+grok --no-leader --no-auto-update \
+  --single 'Find receipt__hub_inbox with search_tool, call it with use_tool, and report its result.' \
+  --max-turns 1 --disable-web-search --no-memory
+```
+
+Both attempts exited 1, without a model turn or hook payload, and reported:
+
+```text
+Not signed in. To authenticate without a browser, run:
+  grok login --device-code
+```
+
+An initial syntax-only attempt incorrectly supplied `--single` without its required adjacent prompt value and exited 2; it is not a model/tool probe result. The corrected commands above are the evidence.
+
+A separate untrusted project was launched under a PTY using `--no-leader --no-auto-update --no-alt-screen --minimal --no-memory`. It displayed sign-in and an authentication discovery failure for `https://auth.x.ai/.well-known/openid-configuration`, then exited 0. No folder-trust prompt was observed, no sibling trust entry appeared, no browser execution was permitted, and no hook payload was produced. Exit 0 here does not prove a successful session. No personal account, cached token, API key or real-home fallback was used; these legs stop at authentication.
+
+The locally shipped MCP guide documents qualified `server__tool` catalog keys and `search_tool` / `use_tool`, so `receipt__hub_inbox` was the requested key. That documented route remains UNVERIFIED in a native model turn. To finish this leg, use an independently authorized account in a fresh isolated home and a disposable real hub, then capture the meta-tool dispatch and the actual hub result; do not reuse the person's home.
+
+## Hooks and payloads
+
+The fixture `.grok/hooks/receipt.json` registered command handlers for `SessionStart`, `UserPromptSubmit`, `Stop`, `StopFailure`, `StopCancelled`, `SessionEnd` and `SubagentStop`. Each handler used the same passive script, with a two-second hook timeout:
+
+```sh
+#!/bin/sh
+/bin/cat >> "$PROBE_ROOT/evidence/hook-payloads.jsonl"
+/bin/echo >> "$PROBE_ROOT/evidence/hook-payloads.jsonl"
+```
+
+The actual generated script contained the absolute sink path. It did not deny actions or invent events. Trusted inspect listed these native event names:
+
+```text
+session_start
+user_prompt_submit
+stop
+stop_failure
+stop_cancelled
+subagent_stop
+session_end
+```
+
+The sink remained absent, so there are no observed hook stdin payloads to publish. In particular, this receipt has no observed `sessionId`, `hookEventName`, `lastAssistantMessage`, stop/interrupt discriminator or main-session/subagent binding. The shipped hooks guide describes `Stop` for genuine main-turn completion, `StopFailure` for API failure, `StopCancelled` for non-completion and `SubagentStop` for subagents, and documents camelCase fields plus compatibility aliases. These are documented hypotheses for the authenticated follow-up, not captured payload facts. Merely registering `SubagentStop` cannot establish main-turn completion.
+
+The local shipped guide bytes consulted were identified by SHA-256 (their documentation content does not substitute for native runtime evidence):
+
+| Guide | SHA-256 |
+| --- | --- |
+| `07-mcp-servers.md` | `67558820ab3f0c49d56f87ce9d6927f2d6d179558f7a1e0466750a9771a43c3a` |
+| `10-hooks.md` | `2a3a12201597fa6ab1885fa473096565a6c99fbfaf656627c65fa15653e14970` |
+| `02-authentication.md` | `f16e7fe4cecc2836643d3474dbbc6c2b4a0ea12edf2b56b8a5a0a4ecb24efbec` |
+
+## Real configuration hashes
+
+Only the controller computed SHA-256/absence of these named real `~/.grok` files, without printing or copying their contents. Grok itself could not read that home. All nine entries matched after the final native probe. This is a bounded inventory, not a claim about every native configuration path.
+
+| File | Before and after |
+| --- | --- |
+| `config.toml` | `cbafbea937a8ad50323aed808e68912706a063c7c88868a8fd9f58252bb68f22` |
+| `version.json` | `182eeb64f0fe20c17ddea37071954ff25b1424f3b807fea13697754c803439f7` |
+| `trusted_folders.toml` | `4e9eee9a1a037d109d59ed1d8112795f55381465cd219266b2f1777d4ec8b945` |
+| `auth.json` | SHA-256 matched; credential-file digest omitted from the public receipt |
+| `config.json`, `settings.json`, `mcp.json`, `managed_config.toml`, `requirements.toml` | Absent before and after |
+
+## Repository validation
+
+The final committed receipt is checked with `scripts/check.sh --changed` on dgx02; the PR and task submission record the exact head and gate result. Hosted CI is independent. No compatibility registry, launcher, generated bundle or native support claim is changed by this documentation-only T0.