@staix/agent-hub 0.28.0 → 0.30.0

package/docs/verification/2026-11-03-pi-title-api.md

@@ -0,0 +1,26 @@
+# Pi 1.5.0 session-title API probe
+
+Task #689, Refs #1055 (T1). Model-free native API receipt, macOS arm64, Node 24.18.1.
+
+The installed `@earendil-works/pi-coding-agent@1.5.0` exposes a working native session-name setter and reader:
+
+- Extension API: `setSessionName(name: string): void` and `getSessionName(): string | undefined`.
+- Session: `AgentSession.setSessionName(name: string)` and the `sessionName` getter.
+- Session manager: `appendSessionInfo(name: string)` and `getSessionName(): string | undefined`.
+
+The [producer](pi-150-title-api.mjs) loads the real package's `DefaultResourceLoader`, `createAgentSession` and extension runner. It registers an account-free probe tool, invokes that callback directly after `bindExtensions`, and asserts the native API changes an initially unnamed session to `Fixture session title`. Both the extension reader and `SessionManager` return that name. After disposal, `SessionManager.open(sessionFile).getSessionName()` returns the same name. No prompt is submitted to an agent or provider.
+
+The native setter appends a `session_info` entry. A handler registered through the real `ExtensionAPI.on("session_info_changed", handler)` receives the new name, also asserted by the producer. Pi delays creating a new session file until a user or assistant message exists. This probe appends a synthetic user fixture to the session manager before calling the setter; the fixture is never sent to a model. It proves native persistence for an existing conversation, not persistence of an empty session.
+
+## Isolation and result
+
+- Fresh HOME under `getconf DARWIN_USER_TEMP_DIR`, separate `PI_CODING_AGENT_DIR`, XDG config/data/cache and TMPDIR. The child environment contains only these paths, PATH and the explicit package path.
+- Exact 1.5.0 package from the existing scratch npm prefix used by the [compatibility receipt](2026-11-03-pi-150-compat.md). The person's default launcher still selects 1.4.0; it was not invoked or changed.
+- Frozen worktree dependencies installed before the probe: `@staix/agent-mem@0.20.1`, matching the exact manifest pin. Native package version independently asserted as 1.5.0.
+- `sandbox-exec` uses `src/local/sandbox.ts`'s network-disabled profile, adds a real-home read/write deny, then grants only read access to the scratch native package and Node installation. Writable files are confined to the disposable HOME. No credentials or live hub connection.
+- SHA-256 manifests of the 15 real `~/.pi` configuration/launcher entries were identical before and after. The manifest excludes sessions, logs, cache and install trees; it is not a claim to hash every installed package or historical session. Private per-file digests remain in the scratch evidence directory.
+- Exit 0, empty stderr, setter/reader/reopen assertions PASS. An initial hand-written sandbox profile terminated Node before the producer ran; the final run used the repository profile and passed.
+
+Reproduction: run `node docs/verification/pi-150-title-api.mjs` with `PI_TITLE_PACKAGE` pointing to the exact 1.5.0 package and fresh HOME/tool-home paths, inside the network-disabled sandbox described above. Do not run with the person's real HOME.
+
+This permits the native-slot implementation for Pi. It does not prove a model-generated `hub_set_title` call, delivery through a live hub, or a live Pi restart. AC7 remains a separate live receipt in #1143.

package/docs/verification/2026-11-03-qwen-0265-acp.md

@@ -0,0 +1,55 @@
+# Qwen Code 0.26.5 ACP receipt
+
+Date: 2026-11-03. Task #684, Refs #888, `qwen` row only. This repeats the [0.26.4 ACP receipt](2026-10-31-qwen-0264-acp.md) on the published `@qwen-code/qwen-code@0.26.5`, with a private npm prefix, isolated HOME and fixed synthetic configuration. No account, real credential, provider inference or ACP prompt was used. It does not admit the separate `qwen-dual` contract (see the [dual-output receipt](2026-11-03-qwen-0265-dual-output.md)).
+
+**Decision: add `0.26.5` to `COMPAT.qwen.verified`.** Every ACP leg passed. No intermediate release and no range is inferred. `latest` on npm is 0.26.6 today; it is not admitted.
+
+## Artifact and isolation
+
+The package was installed under the local scratch workspace in a private prefix with a scratch HOME, cache and temporary directory and empty npm user and global config files. The person's global prefix, `~/.qwen` and `~/.pi` were not installation targets. npm held one lifecycle script, `@qwen-code/audio-capture` `install` (`node install.js`). It was read, found to locate a prebuilt microphone addon with a non-fatal failure path, and replayed under the same isolated environment: exit 0. No install script was disabled to make the probe pass.
+
+| Artifact | Binding |
+| --- | --- |
+| npm release | 0.26.5, `gitHead` and upstream `v0.26.5` tag `db0e4e24a0d89b211b2a15f4af2be22adac71dfc` |
+| npm integrity | `sha512-iqcBqLQDmKvOtRcVvF78l7bf0NpdymGFBo0qNY0ausPezht+PLXkh15vnIILaBKtM4BabtHSv60xWftMomJ7hw==` |
+| `cli-entry.js` SHA-256 | `113efe4104a9fc66f507d34bfd6abbd896ceb77de47f4b468a0825a327fdc6a5` (the same bytes as the 0.26.1 and 0.26.4 entry files: the entry is a loader, the code is in chunks) |
+| `chunks/acpAgent-HO52UOPA.js` SHA-256 | `794bda74c4d100ab3367ae2e5d880ef0a610df4c84d1db1475d78283b75a8e1e` (the chunk name differs from 0.26.4's `acpAgent-D7OFGHAI.js`) |
+| Host | macOS arm64, Node 24.18.1 |
+
+Every native process received a fresh temporary HOME and cwd, private `QWEN_HOME`, `QWEN_RUNTIME_DIR` and `XDG_CONFIG_HOME`, a synthetic API key and `--auth-type openai --model fixture-model --openai-base-url http://127.0.0.1:9/v1 --telemetry=false`. The 0.26.4 receipt's Node preload denied application network APIs and recorded six blocked startup attempts here too; none connected through those guarded APIs. This is preload evidence, not a kernel network sandbox.
+
+Real configuration: SHA-256 of every file under the person's `~/.qwen` and `~/.pi/agent` (excluding sessions, logs, caches, installs and `bin`) and of the globally installed qwen's `cli-entry.js` and `package.json` was taken before and after the producer runs: 9550 entries, identical.
+
+## Native ACP, no prompts
+
+`qwen --acp --bare --advisor off` initialized with protocol version 1 and `agentInfo` name `qwen-code`, title `Qwen Code`, version `0.26.5`. The only offered authentication method was the synthetic `openai` terminal method. No prompt was sent.
+
+`session/new` succeeded. Available modes were `plan`, `default`, `auto-edit`, `auto` and `yolo`, with current mode `default`: the same five ids as 0.26.4. Each transition in `default -> auto-edit -> yolo -> default` returned an acknowledgement, so the hub's ask/default, ask-when-needed/auto-edit and never-ask/yolo map is still a subset of the native ids. The session exposed only the fixture model.
+
+The native leader exited after its owned group received SIGTERM, and the producer confirmed `groupGone: true`.
+
+## Actual published permission handler
+
+An exports-only scratch copy of the published ACP chunk (`export{SubAgentTracker,toPermissionOptions,resolvePermissionOutcome}` appended) was placed beside the original inside the private package, preserving its relative imports. The original chunk was not edited. The fixture invoked the actual `SubAgentTracker.createApprovalHandler` with synthetic client, tool and event ports, not a model-generated tool turn.
+
+- The request carried the fixture session, pending tool-call id, raw input, native MCP tool metadata and permission progress updates.
+- The exact options were `proceed_always_project` and `proceed_always_user` as `allow_always`, `proceed_once` as `allow_once`, and `cancel` as `reject_once`.
+- An allow-once response reached `event.respond` as `proceed_once`; a cancelled outcome reached it as `cancel`; the real outcome helper rejected an unoffered option.
+
+## Not verified
+
+A real model-generated permission turn, a real login or provider, model behavior, Linux and Intel macOS. This receipt did not review upstream source between 0.26.4 and 0.26.5; the claim is the native behaviors above on the exact published artifact. Host changed-source checks and exact-head CI are separate PR evidence.
+
+## Evidence fingerprints
+
+Producers and result JSONs stay outside git under the local scratch workspace.
+
+| File | SHA-256 |
+| --- | --- |
+| `qwen-acp-probe.py` | `12e60602ca5d00ed29473f3afef277b0c5661aca286692864da8fc69ced9d2e2` |
+| `qwen-acp-result.json` | `442f2e33c13232723eb646119f49f52fcb8df06de7c59ee32402ab377525710a` |
+| `qwen-permission.mjs` | `989ba620e7d099b74ec5b4b1efb78d9d6cc96b5ef5b364c058a077dfc8621a31` |
+| `qwen-permission-result.json` | `958a77ea7618e0efd04a78520aadf83654e5b74a0158a05061d0bed4406d7c31` |
+| `deny-network.cjs` | `361148af658dd4b65ed35308622ec99bb882ec5a25fab54581776546f139e892` |
+
+The two probe copies differ from the 0.26.4 producers only in paths and the expected version string.

package/docs/verification/2026-11-03-qwen-0265-dual-output.md

@@ -0,0 +1,40 @@
+# Qwen 0.26.5 dual-output attempt, not qualified
+
+Date: 2026-11-03. Task #684, Refs #888, the separate `qwen-dual` row. The [0.26.5 ACP receipt](2026-11-03-qwen-0265-acp.md) does not qualify the TUI contract. This repeats the corrected [0.26.4 attempt](2026-10-31-qwen-0264-dual-output.md) (the v2 producer, fixed OpenAI-compatible loopback responses, no real model, account or credential) on `@qwen-code/qwen-code@0.26.5`.
+
+**Decision: do not add 0.26.5 to `COMPAT["qwen-dual"].verified`.** Q2 did not pass. Exactly 0.26.1 stays verified for this entry, and `src/adapters/compat.ts` is unchanged for it.
+
+## Artifact and controls
+
+The candidate is the private-prefix package described in the ACP receipt (upstream tag and `gitHead` `db0e4e24a0d89b211b2a15f4af2be22adac71dfc`, Node 24.18.1, macOS arm64). The retained global 0.26.1 install (`cli-entry.js` SHA-256 `113efe4104a9fc66f507d34bfd6abbd896ceb77de47f4b468a0825a327fdc6a5`) served as a read-only matched control, always with a fresh temporary HOME and cwd and the same producer. Each fixture used a PTY, private input and event files, a scratch git project, a synthetic key and a loopback server. The Node network guard's positive control passed; every observed Node process loaded the guard; every owned process group was confirmed gone; the temporary roots were removed. Model inference calls: 0.
+
+Real configuration: the person's `~/.qwen`, `~/.pi/agent` and the global qwen install hashed the same before and after (9550 entries, together with the ACP runs).
+
+## Observed outcomes
+
+| Check | 0.26.5 | Matched 0.26.1 control |
+| --- | --- | --- |
+| Q7 version and guard positive control | pass, 0.26.5 | pass, 0.26.1 |
+| Q2 second submit becomes a separate user turn after the first completes | **fail**: `Q2 fewer than two user events` | **fail**, the same error, same fixture |
+| Q3 shell and native MCP `can_use_tool`, allow, TUI Enter, duplicate refused, read-only control | pass | not selected |
+| Q4 external SIGINT leaves the turn running; person Esc stops it and the next turn works | pass | not selected |
+| Q5 unread output FIFO does not block the TUI answer | pass | not selected |
+| Q6 resume id, no old-submit replay, prior context in the resumed request | pass | not selected |
+
+Q2 fails identically on the already-verified 0.26.1 with this producer, so it is a limit of the held-stream workload the corrected fixture uses and not a 0.26.5 regression: the same outcome the 0.26.4 receipt recorded. It also means this fixture cannot reproduce the queued-submit observation the [original 0.26.1 receipt](2026-10-25-qwen-dual-output-t0.md) rests on. The task gate (promote only when every model-free leg passes) does not allow a `qwen-dual` bump while a required leg is unestablished, and no TUI adapter, queue, cancellation policy or existing admission is changed.
+
+## Source note
+
+Upstream `DualOutputBridge.ts` and `RemoteInputWatcher.ts` have the same blob ids at v0.26.1 (`b475278c`), v0.26.4 (`715a550c`) and v0.26.5 (`db0e4e24`): `1e1a4e71fafd0c29c62e4ca60243449bd698d20a` and `8a3eabf4e29804ce5f63d40d4a083d14f489dbb3`. That is scoped supporting evidence about those two files, not native acceptance.
+
+## Not verified
+
+Q2 on any version with this producer, a real account or provider, model choices and quality, token and quota behavior, Linux and Intel macOS. Explicitly failed and unselected legs above are not relabelled as passes.
+
+## Evidence fingerprints
+
+| File | SHA-256 |
+| --- | --- |
+| `qwen-dual-probe-v2.py` | `114c032afce5caef4f59072f0a1730bc78a70788fd49ad17e5ff2f1eef4c947e` |
+| `qwen-dual-v2-0265-result.json` | `1062244e51f5c1aab71f2778d08116c3c00f81929be9aa209fc3467763cc0471` |
+| `qwen-dual-v2-0261-control-result.json` | `d4384d0b54f42e789f09f44346201b75285b1afafc78eb3d22ff3271b38ce72a` |