@staix/agent-hub 0.30.0 → 0.32.0

package/docs/specs/2026-09-19-agent-hub-design.md

@@ -803,7 +803,9 @@ atomically install that candidate against its persisted pin. Replaying an old
 candidate must never reset the minimum epoch or a grace deadline.
 
 A frame's public header is `{v,type,room,epoch,sender,recipients,seq}` plus nonce,
-ciphertext and signature. Recipients are hub fingerprints, not local peer ids.
+ciphertext and signature. Presence may add the signed optional `ephemeral: true`
+header (#1204 T1); every other value for that optional field refuses. Recipients
+are hub fingerprints, not local peer ids.
 The body is opaque encrypted bytes, including any eventual local addressing,
 kind, trace and text. Frame AAD is exactly UTF-8 `room|epoch|sender|seq`. A
 sender-specific AES key is HKDF-derived from the epoch root and room/epoch/sender/
@@ -974,7 +976,14 @@ survive queue ACKs/restart: the last accepted digest or an identical retained ol
 packet is idempotent without requeueing; conflicting or
 unknown lower sequences refuse. FIFO uses SQLite admission row order, never lexical
 sequence strings or clock ties. Full queues refuse new packets without evicting
-accepted ones. Prior-epoch grace may expire a packet before its ordinary TTL.
+accepted durable ones. Ephemeral presence replaces only prior ephemeral rows of
+that sender and retains only currently ready recipients; disconnect/restart
+removes those recipients, while sender floors and durable work remain. The same
+queue/byte caps still apply. A frame-level `queue_full` includes its verified
+digest. Links retain the sealed frame and retry after 250 ms, doubling to 30 s,
+with one frame awaiting storage acceptance so later sequences cannot overtake it.
+Applications stay in the local outbox; T2 owns receipt persistence and deadline/
+restart replay changes. Prior-epoch grace may expire a packet before its ordinary TTL.
 
 One packet per recipient socket is in flight. `{v:1,type:"received",digest}` removes
 only that identity from the packet's remaining recipients, then returns
@@ -1114,6 +1123,16 @@ not project config or synced memory. A hub stop closes links and retains members
 A person may explicitly import a pinned signed roster to reactivate a left room;
 automatic link traffic cannot reactivate it.
 
+
+The optional ephemeral field is used only after an opted-in connection receives
+`ephemeral: true` in the broker ready control. The upgrade header is
+`x-agent-hub-ephemeral: 1`; brokers preserve the old closed ready shape for
+clients that do not opt in. Missing advertisement means legacy presence frames,
+with dedupe/backoff still active. The broker withholds ephemeral frames from older member hubs
+until upgraded; application chat stays wire-compatible. See the [compatibility
+ceiling](../design/bus.md#room-wire-compatibility-1204-t1); #1204 T4 owns full codec
+feature negotiation.
+
 ### Durable state and outbound link
 
 `<hub-state>/rooms/rooms.db` is schema version 1, SQLite DELETE/EXTRA with exclusive
@@ -1152,9 +1171,12 @@ at most 8 pending packets/2 MiB per link, 1 MiB packet/backpressure limits and a
 minutes and do not block local work. Stop, leave, replacement and rotation fence
 all awaited work by link generation.
 
+With latest-per-sender coalescing, A awaiting C can have its queued request replaced by A's broadcast reply to B. T3's periodic idle refresh requests another observation without waiting for a state change or reconnect; per-(sender,recipient) coalescing remains a possible stronger transport design. Legacy brokers retain the state-change/reconnect behavior without periodic refresh.
+
 Presence is an encrypted, signed frame containing only exposed peer ids and closed
 idle/busy/paused/offline states. It is sent on connection and coalesced peer-state
-changes, never titles, bodies, private task context or credentials. Unknown payload
+changes, skipping identical snapshots except explicit peer refresh exchanges,
+never titles, bodies, private task context or credentials. Unknown payload
 types and unexposed ids refuse before replay commit. Broker ACKs are transport
 facts only. A canonical room/recipient-bound frame that is refused or stale is
 recorded in a durable metadata-only drop ledger before transport retirement ACK.
@@ -1256,15 +1278,20 @@ exposed local peer's queue**. It does not mean native or model execution. Person
 views say **completed (admitted)**. Broker `stored` means accepted ciphertext
 only; a transport retirement ACK is not application completion.
 
-Schema3 of the private `rooms.db` migrates schema1/2 without replacing identity,
+Schema5 retains a nullable canonical outgoing content hash. Cross-root reuse of
+a retained application requires matching content and peer/recipient, no disposition
+or permanent hold, and inherited creation/expiry times; legacy NULL refuses it.
+Schema5 of the private `rooms.db` migrates schema1 through 4 without replacing identity,
 pins, counters, floors or retained traffic. A receiver commits its crypto inbox,
 then application `pending -> dispatching` before publishing into the separate
 Bus journal. A crash or failure in that cross-DB publication window becomes
-`needs_review`, with no automatic republish or fabricated receipt. Sender
-`dispatching`/`accepted` rows become `needs_review` at restart. A same-process
-reconnect drains never-handed offline queues once. A late signed receipt is kept
-as evidence on `needs_review` and shown with the person's disposition view; it
-never auto-settles. Known safe refusals retain the Bus's existing poison policy.
+`needs_review`, with no automatic receiver republish or fabricated receipt.
+Sender `dispatching`/`accepted` rows recover from validated durable intent under
+the same application and delivery ids, retaining their original queue expiry.
+A valid late signed receipt may settle an unresolved ordinary sender hold;
+invocation uncertainty remains person-settled. Person dispositions and invalidated
+recipient bindings remain authoritative. Signed
+remote safe refusals are terminal; native poison-envelope policy is unchanged.
 
 Signed seq/floors are the permanent primary replay protection. Duplicate seqs
 are retired without a second admission; a known identical completed application
@@ -1275,6 +1302,9 @@ oldest settled rows are evicted first. Pending, dispatching and unresolved
 `needs_review` are never evicted. An all-unsettled cap refuses with the room and
 count. Outside retention or after settled eviction, there is no historical
 app-id dedupe claim; an old signed frame is still refused by its seq floor.
+Automatic resend can reach this settled-eviction ceiling and repeat admission
+under a fresh ciphertext sequence: exactly once within dedupe ceiling. Pinning
+retryable identities or #737 receipt confirmation is the upgrade path.
 
 The trace high-water mark is kept for the tombstone retention (30 days / 10,000
 per room, settled rows evicted first); outside it there is no historical trace
@@ -1288,16 +1318,17 @@ Offline Bus queues count toward the 200-per-room ceiling before transport starts
 `hub_send` refuses beyond it. Original host deadlines survive handoff and restart.
 Unknown legacy deadlines fail closed to `needs_review`. Machine-local
 `rooms.ack_timeout_s` defaults to 600 (1..86,400); `rooms.queue_ttl_h` defaults to
-24 (1..168). A single deadline-driven host timer handles ack/queue expiry. No
-uncertain work is silently retried. Explicit terminal-history retries without
+24 (1..168). A single deadline-driven host timer handles ACK retries and queue
+expiry. Only validated durable sender intent is retried automatically; missing
+or corrupt local evidence remains held. Explicit terminal-history retries without
 recipient proof refuse; the person can author a fresh message deliberately.
 An expired or missing original enqueue deadline also refuses a person retry
 before any disposition is recorded; a retry never invents a fresh TTL.
 
 The ACK deadline starts at durable application handoff, before a broker `stored`
-reply, and is never extended by that reply. An unstored frame therefore becomes
-`needs_review` within the same ACK timeout instead of holding the peer for the
-queue TTL. Known pre-admission capacity or journal-unavailable refusals retain
+reply, and is never extended by that reply. Its expiry schedules another attempt
+under the same application id, without resetting the original queue TTL. Queue
+expiry or a permanent refusal ends automatic sending. Known pre-admission capacity or journal-unavailable refusals retain
 their pending plaintext for the next online/disposition retry without preventing
 later room packets and receipts from being processed. Status reads apply no
 disposition. Settled chat plaintext rows are pruned independently of presence
@@ -2782,6 +2813,12 @@ push `accepted` and show none of them.
   sources add protocol 15 (0.12.17 through 0.12.19); the transition from a real
   0.12.19 hub is not yet proven.
 
+## Amendment: inherited Claude channel marker requires direct-parent evidence (issue #1171)
+
+- `AGENTHUB_CHANNEL=1` alone does not enable push. Claude Code child processes, including `daemon run` and `bg-spare`, inherit it without the development-channel flag. The plugin's direct parent must have a bounded, readable `ps -ww` row whose leading argv tokens are `claude --dangerously-load-development-channels` and one exact supported target (`plugin:agent-hub@agent-hub` or `server:agent-hub`). Print/background/daemon forms, a repeated development-channel flag, unreadable or malformed output, a changed parent pid, and unknown targets fail closed to tools-only.
+- The classifier is conservative because `ps` renders a flattened command line; matching is restricted to the prefix and remaining tokens are checked for known mode-changing forms. This is same-user process observation, not authentication. No client-side Claude channel capability was found in the inspected Claude Code 2.1.318 client path, and the server's own advertised capability is not proof. Unknown evidence keeps messages queued for `hub_inbox`.
+- `status.json` reports `attachMode` and a closed `attachEvidence` label for an attached Claude peer; human `ahub status` shows the same pair. Older clients that omit the evidence field retain their prior attachment behavior and display `unreported`.
+
 ## Amendment: channel queue visibility and explicit pull (issue #493)
 
 - A channel session's `hub_inbox` reads the daemon queue through the same
@@ -3945,6 +3982,8 @@ run has no hub command lineage.
 
 ## Amendment: standalone attention window (#391 Task B, supersedes #280 dashboard pet)
 
+Historical surface, retired by #1012. Current presentation contract: [console surfaces](../design/agent-hub-architecture.md#console-presentation-surfaces).
+
 The #280 phase-4 dashboard pet is replaced by an optional standalone macOS JXA
 window. Task B adds the window first; #391 Task A removes the existing in-page
 character and retains shared attention counts/navigation. Terminal characters
@@ -6452,3 +6491,77 @@ Each pack supplies criterion ids in its rubric and exactly one advisory check en
 ## Amendment: research campaigns, experiment receipts and runner attestation (#930, #932, #1018)
 
 The implementation contract for #929 R1 and R3 and for #1018 is `docs/specs/2026-11-01-research-campaigns-design.md`: campaign, protocol, attempt and receipt schemas and bounds; the provenance levels `declared`, `host-observed`, `runner-attested` and `person-attested`; the Board tables; the person-only activation, attestation and runner registration; the `ahub study` and `hub_study_*` / `hub_experiment_*` wire names; the `research_records` recovery feature; and the delivery slices (#596 to #602). Slices that must differ amend that document in their own PR.
+
+## Amendment: anchored review packages (#1056)
+
+The current contract is recorded in [Task Board](../design/task-board.md#anchored-review-packages-1056). Optional finding anchors use the published acon review shape, with stricter hub UTF-8 write bounds. Person drafts are board-local until one explicit console-authorized Send creates one immutable package and one count-only history entry. Owner completion can claim sent comment IDs resolved without claiming person verification. Placement is recomputed over guarded task-scoped Git/projection material; stored anchors never move.
+
+The acon plugin uses `ActionMeta` and `host.ui.review` from the published DOM-free 0.1.3 contract as types only; there is no new runtime dependency or renderer. A private/PII view withholds text, and trusted package markers exclude quote/body content from logs, tails, incoming labels and memory capture without making a public task private. Recovery sections are optional for older snapshots. The owner's live document package-format confirmation remains a separate manual check; fixture and code evidence do not claim that confirmation.
+
+### Receipt publication ordering (#1204 T2)
+
+A chat ciphertext transport ACK follows the signed receipt ciphertext's local
+durable RoomStore outbox commit. The receipt replays after reconnect or restart
+until the broker confirms storage. Waiting for broker storage before the chat ACK
+would deadlock at capacity one. No receipt or native completion is inferred from
+socket send alone.
+ACK after durable local commit of either the receipt or the inbox entry.
+Deferred application admission retains the durable crypto inbox entry, ACKs the
+chat to free broker capacity, and later commits its final receipt to the same
+durable outbox when admission resumes.
+
+A session keeps its refresh request pending for every asked recipient until a
+validated presence from that member arrives. Later non-reply snapshots retain
+requestReply while anyone is pending; replies never carry requestReply. The set
+is bounded by the current roster and resets at reconnect or membership change.
+
+Room application retries preserve the application id, canonical delivery id and
+original queue TTL, using a fresh authenticated ciphertext sequence where needed.
+The ACK timeout schedules resend rather than uncertainty; queue expiry or a
+permanent refusal remains inspectable. A signed late receipt may settle an
+unresolved ordinary remote hold once without overriding a person disposition.
+Invocation uncertainty retains its person-only ledger hold. Receiver application
+deduplication, current identity/privacy fences and all caps remain.
+
+
+### Room liveness and person-visible rotation (#1204 T3)
+
+The T3 contract is [room liveness and epoch changes](../design/bus.md#room-liveness-and-epoch-changes-1204-t3).
+The broker's existing negotiated ephemeral bit alone enables 30-second periodic
+`requestReply` publication and three-period (90-second) local observation aging.
+It adds no wire payload kind, codec advertisement or native `PeerState` value.
+Legacy brokers have no periodic refresh or aging and explicitly report liveness
+untracked, with a broker upgrade step. The existing state-change dedupe,
+request/reply fencing, caps, privacy and T2 receipt/dedupe ceilings remain.
+
+An asynchronous, idempotent stop fences publication synchronously, attempts one
+signed offline snapshot in FIFO order behind an attempted head, and disconnects
+within two seconds while retaining durable intents and receipt outbox rows.
+Failure leaves supporting recipients to age the observation; it grants no
+remote process-stop or execution authority. Refresh period and observation clock
+are fixture seams. Restored observations cannot establish freshness; clock
+rollback makes displayed liveness unknown and status reads mutate neither time
+nor delivery state. Aging is advisory only and never changes outbound admissibility;
+signed roster, exposure, link and Bus proofs remain authoritative. Explicit signed
+offline presence keeps its existing handling, and the broker can queue for members
+that are not live.
+
+Person previews for epoch-changing owner exposure, invite acceptance, revocation
+and existing-room `join --roster` adoption bind the current roster digest and the
+sorted, exact set of already sealed unresolved Store delivery ids. Link
+application publication is quiesced before the final recheck and commit; a new or
+settled id invalidates the preview. Bus-only unsealed work is excluded.
+RoomStore uses its existing schema and `boundary_refused` reason to quarantine
+old active intents atomically with the epoch and remove sendable ciphertext.
+T2's crash-gap quarantine remains the recovery fence, not a new T3 repair.
+T3 gives matching local Bus deliveries `needs_review` with fixed journal reason
+`room epoch rotated; inspect ahub queue show <id>` and room-status
+`holdReason: "epoch rotated"`. Terminal rows and person
+dispositions remain authoritative; rotation is not completion, replay or
+cancellation. A committed rotation whose local journal hold cannot be written
+returns `epoch_rotated_hold_unavailable` with an inspection step, without
+restoring old sendability.
+
+Source and isolated fixture coverage are listed in [dogfood](../dogfood.md).
+Those fixtures do not establish installed or two-machine liveness. #1204 remains
+open for T4's full capability advertisement and compatibility work.

package/docs/specs/2026-09-19-multi-project-design.md

@@ -99,8 +99,13 @@ visual redesign, automatic merging and npm publication.
 Same-machine cross-project routing is no longer out of scope: work that belongs to another project that runs agent-hub is registered on that project's board.
 
 - **Target.** `project` names a project in the machine registry (its canonical root or its id). An unregistered target, the caller's own project and a target whose daemon is not running are refused, the last with the person's action (`ahub up` in that project). Nothing is queued.
-- **Who and what.** The person (`ahub task handoff --project <root|id> [<class>] <title...> [--path <p>]... [--issue <n>] [--task <n>] [--detail <text>]`), or a configured planner or the conductor (`hub_task_handoff`). A feature or behavior change first needs a spec issue in the target repository, passed as `issue`; a mechanical chore goes straight to a task. The request is closed (unknown fields refused), bounded (8 KiB whole) and repository-relative for paths.
+- **Who and what.** The person (`ahub task handoff --project <root|id> [<class>] <title...> [--path <p>]... [--issue <n>] [--task <n>] [--detail <text>] [--duplicate-ok <reason>]`), or a configured planner or the conductor (`hub_task_handoff`). A feature or behavior change first needs a spec issue in the target repository, passed as `issue`; a mechanical chore goes straight to a task. The request is closed (unknown fields refused), bounded (8 KiB whole) and repository-relative for paths.
 - **Transport.** The origin's daemon reads the target's control descriptor (same machine user) and sends `task_handoff` as a console-role control message with origin `{ projectId, peer, taskId? }`. The target's `Tasks` creates an ownerless proposal made by the hub, with the origin recorded in `task_handoff_origin`; its own routing and planner take it from there. The origin peer has no identity or authority in the target: it is a record, never a roster peer.
 - **Follow-back.** On accepted, in review, approved, declined and cancelled the target sends `task_handoff_event`; the origin records it in `task_handoff_outbound` and delivers one `kind: task` envelope to the requesting peer (`agent-hub task 123 approved: PR #N at <sha>`: an event name, a PR number and a full head, never target text). An origin that was down asks the target for the current state of its open handoffs when it starts (`task_handoff_states`). `ahub board --handoffs` and `hub_task_handoffs` list them.
+- **Duplicates and cancel (#1175).** A handoff naming a spec issue (`issue`) that already has an open task on the target's board (proposed, backlog, in progress, in review or changes requested; a `[pii]` row is never named) is refused before any row exists, with the open task ids, unless the sender passes `duplicate_ok` (a reason of up to 300 characters, recorded in the task's detail). An issue number identifies work only together with its repository: `sdlc.repo`, `external {repo, issue}` (an imported backlog row) and a slug `refs.repo` that name another repository than the target's do not count. The target's configured, rostered conductor may cancel a handed-off task that nobody has accepted and that has no execution evidence, with a reason; the origin hears `cancelled` through the follow-back, never the reason. A target from before this check refuses `duplicate_ok` as an unknown field, which the sender reports as "upgrade the target hub or hand off without `duplicate_ok`".
+- **Idempotent request (#1203 T1).** The origin mints a `handoffKey` (UUID v4) per request, or takes the one a retry passes (`--key`, `handoffKey`), and sends it in the `task_handoff` request body to a target that advertises `task_handoff_key`. The target stores it with a digest of what was asked in `task_handoff_origin` (unique per origin project) and writes the proposal and the origin row in one board transaction (`Board.proposeHandoff`). A key it already holds answers with that task (`replayed`) before the duplicate check and before any PII screen; the same key for a different request is refused. A timeout or a closed connection is not a refusal: the origin sends the same key once more, then asks the target by key (`task_handoff_by_key`, answered only to the asking project and only with the fields a live event carries), and otherwise reports the new refusal code `outcome_unknown`, naming the key to retry with. The origin records its outbound row from the reply or the by-key answer, never resetting a row that already exists.
+- **Converging follow-back (#1203 T2).** Each `task_handoff_event` carries `seq`, the target task's flow revision (its history length), to an origin that advertises `task_handoff_seq`. The origin keeps the sequence of the last applied event in the outbound row and ignores an event whose `seq` is not newer: it changes nothing and sends no envelope, decided inside the one board write, so events that arrive out of order (each uses its own connection) cannot move a row backwards. An event without `seq` (an older target) applies as before. The origin's catch-up (`task_handoff_states`, which now also returns `seq`) runs at start, every 5 minutes and when a target's control descriptor changes, over every row that is not cancelled and, for an approved one, was updated within the last 7 days (a reviewer can withdraw an approval; the origin only learns of it through the sequence), with no 200-row cap and in requests of at most 200 task ids. `changes_requested` and `reopened` are events, sent only to an origin that advertises `task_handoff_seq`. A catch-up pass never overlaps another, never holds a board write and stops at shutdown. `ahub board --handoffs` still lists the 200 most recently changed rows; that cap is for display only.
+- **Diagnostics and repair (#1203 T3).** Every failure is visible and repairable by the person. A connection to a target that fails is named by the error's code and never by its message: 4426 (the wire versions share no protocol) is `older_target` and says to upgrade whichever hub is older, 4404 (another hub or instance answers) is the new refusal code `mismatch` and says to check `ahub projects`, a connect timeout says the hub may be stuck (`ahub status`), and only an unreachable hub says "not running" with `ahub up`. A failed notify, catch-up pass or handoff writes one `hub.log` line per target and cause in each window (15 minutes), with a fixed cause phrase and never a task title or the target's text. `ahub task handoff --list` (the person's command, read-only) shows each handoff with its age since the last report and `reachable`, `unreachable` with its cause and next step, or `moved` (the project id is not in the machine registry: it was removed or its root changed, and the id is a hash of the root), read from the registry and the target's descriptor file without opening a connection. `ahub task handoff --sync` (the person or the conductor) runs a catch-up pass now and answers with the refreshed list; it waits for a pass already running and then runs its own, for at most 20 seconds (under the caller's 30 second control timeout, because the pass asks targets one after another): past that it answers with the list as it stands, `syncing: true` and the number of targets still pending, the pass goes on in the background, and the CLI prints "catch-up still running for N targets: run `ahub task handoff --list` in a minute". An agent gets the same list from `hub_task_handoffs` (now with `age`, `ageMs`, `reach` and `cause`) and cannot sync. A catch-up request that gets no usable reply (the target refused it, timed out or dropped the connection) is a failure like any other: its target reads `unreachable` with the cause "no answer to the state request" and the step `ahub status` in that project, one log line is written, and the earlier failure is not cleared. If the pass itself fails, `--sync` answers `synced: false` with that cause instead of `synced: true`.
+- **Follow-back envelope (#1203 T1).** It carries `refs.handoff {project, task}` (the target's project and task) and no `refs.task`, so the bus never judges it against a local task that happens to have the same number; the one-line body is unchanged.
 - **Privacy.** Refused during a private (PII) turn and for a `[pii]` task named with `task`; the target refuses text that matches a PII pattern or that its screen cannot clear. No memory, evidence or turn content crosses beyond the handoff fields.
-- **Compatibility.** The additive daemon feature `task_handoff` (no protocol bump: a new message type is answered as unknown by an older hub, and an optional field is ignored). An older target is refused with a named "upgrade the target hub" error, and a recovery target without the label is refused while either handoff table holds a row.
+- **Compatibility.** The additive daemon features `task_handoff` and, from #1203 T1, `task_handoff_key` and `task_handoff_seq` (the latter: a target sends `seq` and the two new events only to an origin that has it; an origin ignores a missing `seq`). `task_handoff_key` (an origin sends no key to a target without it and keeps the earlier behavior, a timeout there is `outcome_unknown` without a retry key, and the request is not repeated). Neither feature bumps the protocol: a new message type is answered as unknown by an older hub, and an optional field is ignored, except `duplicate_ok` and `handoffKey`, which an older target refuses as unknown fields (so the key is sent only to a target that advertises it). An older target is refused with a named "upgrade the target hub" error, and a recovery target without the label is refused while either handoff table holds a row.

package/docs/verification/2026-11-04-1171-channel-client-evidence.md

@@ -0,0 +1,31 @@
+# Channel client evidence for #1171
+
+## Scope
+
+This investigation checked the installed first-party Claude Code 2.1.318 artifact and read process metadata on macOS on 2026-11-04. It did not start a model session, modify a running client, capture a live MCP handshake, or establish that a particular notification reached a model.
+
+The artifact was the existing native installation at `~/.local/share/claude/versions/2.1.318`. Its embedded build metadata names Git revision `ca1fa9dea62c1027756786c841c548788644560d` and build time `2026-11-03T18:52:53Z`.
+
+## Client initialization and channel registration
+
+The inspected stdio MCP client construction passes capabilities through `_Xt`, `pOn` or `uOn`, and `W`. That path builds roots/list-change and elicitation capabilities, with conditional MCP application extensions. The inspected path contains no channel-specific client capability or flag-dependent channel opt-in field.
+
+Channel registration is a separate path. It checks the server's channel declaration, protocol compatibility, provider and organization policy, and the session's selected channel entries. A generic MCP client capability therefore cannot establish that this session opted into this channel. This is a bounded observation about these paths in 2.1.318, not a claim about every client version.
+
+The [official channel reference](https://code.claude.com/docs/en/channels-reference) describes the channel capability as a server declaration. It also documents the development flag as interactive-only; print mode ignores that flag. No usable client initialization signal was found in the inspected artifact and reference.
+
+## Direct-parent fallback
+
+The existing `claudeNativeLaunch` implementation prepends the development-channel flag and a selected exact target before native passthrough arguments. The target is normally `plugin:agent-hub@agent-hub`; its existing matching MCP configuration path can select `server:agent-hub`.
+
+A passive process observation corroborated this layout for the running native TUIs: process 10310 and several other observed TUIs had the exact known flag/target prefix. The observed background daemon, process 17739, did not. Two other Claude process rows exposed only the process name, which cannot establish support. The observation emitted only identifiers and classification results, without retaining command bodies, paths or prompts.
+
+The proposed fallback was communicated to the reviewer before implementation: require the existing launcher marker together with bounded evidence from the direct parent's actual invocation. An inherited marker alone is insufficient. Unknown process metadata must remain tools-only. Searching an arbitrary command substring would be unsafe because a prompt or an option value can contain the same flag text.
+
+The flag evidence has a deliberate ceiling: it establishes the inspected launch form, not organization policy, user confirmation, protocol registration or model consumption. Unrecognized launch forms must remain pull-only. The separate #1172 settlement work is needed for notifications that are accepted by the transport but never confirmed by the session.
+
+## Verification boundaries
+
+Synthetic fixtures must distinguish an inherited marker without parent evidence from the supported launcher form, and keep the former's messages readable through `hub_inbox`. Negative cases include print/background forms, repeated or misplaced flags, unknown targets and unavailable process metadata. Status must expose a closed evidence value, never command text.
+
+Source tests, the committed-head remote gate, hosted CI and native message-consumption receipts are separate evidence. This investigation supplies no native delivery receipt.

package/docs/verification/2026-11-05-0.31.0.md

@@ -0,0 +1,182 @@
+# 0.31.0 release verification
+
+This record covers release preparation and source review. It claims no installation, no running-hub upgrade to 0.31.0 and no live TUI launch.
+
+## Candidate
+
+Initial preparation: version 0.31.0, prepared from main 3185dd4c (33 commits since v0.30.0; the tool's count of 34 includes this branch's CHANGELOG commit 7e2a3257, 16 of them `feat`; bump rule: minor). The release commits carry the version, the CHANGELOG section, the bundle and the documentation stamps.
+
+## Completion after the release follow-ups (task 744)
+
+The single intended release remains 0.31.0. Completion starts from main
+`9e4f24c3b222b6faa40309eeb0a91a54107dfe6e` on the exact branch
+`release/0.31.0`; no version, runtime, bundle or fixture version is changed here.
+At preparation, npm's `latest` was 0.30.0 and the remote `v0.31.0` tag was absent.
+The earlier release PRs #1218 and #1223 are already merged, but the four source
+PRs below landed afterward. This follow-up must also be merged with a merge
+commit and the default subject, preserving the reviewed-stamp ancestors for the
+guarded tag. It neither records consent nor creates a tag or npm publication.
+
+The board approval head equals each merged PR's head (`mismatch: false`).
+GitHub readback found every listed check completed successfully or skipped,
+with no failed or pending check. Counts below are head-specific hosted checks,
+not installed/native acceptance or a new full-suite result for this docs branch.
+
+| PR / task | Approved head | Merge commit | Hosted CI |
+| --- | --- | --- | --- |
+| [#1213](https://github.com/STAIxBWLB/agent-hub/pull/1213), task 739 | `6a304ccbdc2b9ab511f6f85af7fb8fbaee18f1ce` | `c58958d3a13c4de0317fdfb72745a88943315e93` | 19 success, 2 skipped |
+| [#1224](https://github.com/STAIxBWLB/agent-hub/pull/1224), task 714 | `cf20b1d30fe314938c013b34b8a394e8aed1474f` | `b7408fffccdfcdce88fd0e04c2cbecf91c44d7c8` | 21 success, 2 skipped |
+| [#1215](https://github.com/STAIxBWLB/agent-hub/pull/1215), task 734 | `4ffbab00e3a10a32c2955c76873b424f4d5434f8` | `4a4f87ed445bb32df13f9b371f8792dde740de65` | 19 success, 2 skipped |
+| [#1228](https://github.com/STAIxBWLB/agent-hub/pull/1228), task 743 | `8c6d28bbd49f9d2b28e5ab62c28fd81d8a1e6f72` | `9e4f24c3b222b6faa40309eeb0a91a54107dfe6e` | 19 success, 2 skipped |
+
+CHANGELOG now includes failure causes/unresolved failed counts, the handoff
+reachability/repair diagnostics, the exact agent-mem 0.21.0 pin and complete
+bounded declined inspection, and the missing task 739 convention entry.
+Unreleased is empty. The old #1173 wait for agent-mem#260/#261 is replaced:
+AC4 is complete, while automatic v3 sync remains unsupported pending the
+activation and fresh host-attestation path in agent-mem#281. No activation or
+attestation is fabricated. Task 736/T3 and task 737/T4 are not in this release.
+
+The hub N-1 fixture stays 0.30.0 with agent-mem 0.20.1. The additive nullable
+`deliveries.failure_cause` column does not raise hub schema version 2; the older
+recovery reader ignores the extra diagnostic snapshot key. The existing
+`peer_takeover` compatibility statement is retained. Memory claims are limited
+to [agent-mem's published 0.21.0 notes](https://github.com/STAIxBWLB/agent-mem/blob/v0.21.0/CHANGELOG.md):
+its N-1 proof uses 0.20.3, not the 0.20.1 bundled by hub 0.30.0. Those notes keep
+curated/capture/hook-spool/candidate/work-list/setup receipt v1/v2 formats,
+shared-v1/generation/v1-v2 shard sync and index version/name unchanged, and
+record 0.20.3 refusing activated v3. This report does not extend that versioned
+proof to 0.20.1 or claim supported v3 activation/automatic sync.
+
+### Document review for task 744
+
+The 14 stale documents were reviewed against the task 714, 734 and 743 deltas
+only; task 739 changes classification metadata without runtime behavior.
+Changed documents:
+
+- `docs/quickstart.md`: correct the 0.31.0 upgrade paragraph, additive failure
+  column, current exact memory pin and the automatic-v3 limitation; retain the
+  historical 0.30.0 pin note and global CLI/plugin update step.
+- `docs/operations.md`: correct the mismatch next step (`ahub projects`, with
+  `ahub up` conditional on the intended target not running).
+- `docs/security.md`: correct the old 0.18.0 pin; distinguish safe status
+  placement counts from failure logging and bounded person-only inspection;
+  state the activation/attestation limitation.
+- `docs/agent-notes/adapters.md`: carry typed structured failure diagnostics
+  without treating the diagnostic as settlement or trusting native text.
+- `docs/agent-notes/bus.md`: preserve typed causes through persistence/retry,
+  use metadata-only unresolved counts, and distinguish unavailable from zero.
+
+Reviewed without content changes:
+
+- `README.md`: version/protocol and high-level memory/handoff claims remain true.
+- `docs/agent-notes/README.md`: historical background is unchanged.
+- `docs/agent-notes/benchmarks.md`: no benchmark protocol or end-cause change.
+- `docs/agent-notes/budget.md`: quota/accounting and pause semantics are unchanged.
+- `docs/agent-notes/daemon.md`: current policy/profile sync fences and handoff
+  diagnostic codes, authority and bounded sync behavior remain accurate.
+- `docs/agent-notes/local-worker.md`: the watchdog cause is additive; cancellation
+  and uncertainty remain unchanged, with typed diagnostics owned by adapters.
+- `docs/agent-notes/tasks.md`: task/handoff authority and the write-time memory
+  projection remain valid.
+- `docs/agent-notes/tests.md`: fake boundaries, exact-pin fixtures and the
+  type-only overload adaptation do not change the test instructions.
+- `src/cli/help.ts`: handoff `--list`/`--sync` match main and the argument parser;
+  status/queue/declined forms and native entry definitions are unchanged.
+
+Only these 14 reviewed documents were restamped through
+`bun scripts/release-prepare.ts restamp <document>... --reviewed` at the reviewed
+content commit `af37f8fd8b44a2c566aa47629ec5b02ee9f91d69`. The stamp-only commit
+`7db76b365d0b3e0ef0b946468193dab7b3393bd8` retains that ancestor; the already
+fresh models document was not restamped.
+
+### Completion checks for task 744
+
+On dgx02, `remote_dev.py verify` checked committed head
+`7db76b365d0b3e0ef0b946468193dab7b3393bd8` (tree `656a468fbfd1`) with
+`node scripts/check-docs.mjs --require-fresh && scripts/check.sh --changed`.
+The run completed in 31 seconds with:
+
+```text
+docs: OK (0 stale documents)
+roles: OK (17 bounded definitions)
+inventory: OK (3276 entries, 2121 classified, 1155 in the baseline of known-unclassified keys)
+package: OK (793 files, @staix/agent-hub@0.31.0)
+check: --changed found no affected tests
+check: OK (changed)
+```
+
+Typecheck and bundle freshness also passed. This was a documentation-only
+changed gate, not a new full runtime test run. The following documentation-only update
+records that completed result; final-head checks and hosted CI are recorded on
+the PR and remain the merge gate. No tag, consent, publication, installation or
+live upgrade was performed.
+
+## Reviews
+
+Pull requests named by the commits since v0.30.0: #1216, #1211, #1214, #738, #1212, #1210, #1207, #1209, #1206, #1205, #1202, #1201, #1192, #1200, #1197, #1195, #1194, #1189, #1191, #1190, #1186, #1183, #1188, #1181, #1185, #1187, #1184, #1182, #1170, #1169, #1168, #1167, #1166, #1165.
+
+`#738` in that list is hub task 738 named in #1212's subject, not a pull request of this range.
+
+Each of the 33 merged at the head its hub task approved, read from the board (`ahub board --json`: `approval.head` equals the task's `refs.commit` and the PR's head, `mismatch: false`), with that head's CI green on ubuntu and macOS (18 to 21 checks pass, 2 skipped, none failing). Approvals by claude unless named:
+
+- #1165 (task 695) at 5d1c984e; #1166 (696) at 71f1e1f0; #1167 (693) at ca882f2b; #1168 (694) at 59f352da; #1169 (697) at e5500129; #1170 (700) at 884036ba; #1181 (708) at 0b9fbe07; #1182 (715) at 56521a35; #1183 (702) at 56f1e7c5; #1184 (710) at 97bfcba4; #1185 (703) at c762d8a7; #1186 (704) at 96703ec9; #1187 (711) at 9e2b2719; #1188 (716) at 72958d19; #1189 (712) at 054cc353; #1190 (724) at 1ecdeb32; #1191 (717) at db519b67; #1192 (722) at dd5e87ff; #1195 (705) at 61168f74; #1197 (723) at 680f3c1f; #1200 (727) at a6c886bb; #1201 (718) at 96d01a2d; #1202 (725) at e0a5c1a3; #1205 (728) at e2bca26f; #1206 (732) at c38895a6; #1207 (719) at 6e50af13; #1209 (730) at b3d9f52c; #1210 (731) at 744e4e21; #1211 (733) at 26b59ce3; #1212 (738) at 4c8eca47; #1214 (740) at 05a6dc50; #1216 (735) at 5fa15b5c.
+- Approved by jcode: #1194 (726, the claude-implementer 2.1.318 receipt) at 2c245d8b.
+- No merge is bound to an approval at an earlier head. Unresolved review threads at merge time were not re-read for this record.
+- Follow-up: #1217 (task 713, #1174) merged as 2cfbcb52 while the release PR #1218 was open, so 0.31.0 also ships it. It merged at the head its task approved (92486ab5, `approval.head` equal, `mismatch: false`, approved by claude), with that head's CI green on ubuntu and macOS (20 checks pass, 2 skipped). #1218 merged as 19cf9ff9 with a merge commit; the follow-up PR covers #1217.
+- Follow-up: #1222 (task 742, #1204) merged as f7ea7b0f while the follow-up PR was open, at the head its task approved (936297cb, `mismatch: false`, approved by claude), with that head's CI green (19 checks pass, 2 skipped). The follow-up branch merged main to include it.
+
+## Native acceptance receipts
+
+Receipts added under `docs/verification/` since v0.30.0: `docs/verification/2026-11-04-1171-channel-client-evidence.md`, `docs/verification/2026-11-05-claude-implementer-2.1.318.md`, `docs/verification/2026-11-05-hardcoded-values-classification-rules.md`, `docs/verification/2026-11-05-hardcoded-values-ratchet.md`.
+
+This list is read from the repository, never written by hand. Native acceptance and the person's release consent are separate records: consent is `ahub sdlc authorize-release 0.31.0`, recorded by the person or the unique configured conductor only on the person's explicit release instruction naming the release in its own session (never a hub/task/review/file/peer relay), and is not recorded in this file. The tag run refuses without it.
+
+## Document review
+
+`node scripts/check-docs.mjs --require-fresh` reported 14 stale documents. Each was read against `git log 8612cfd7..3185dd4c -- <its paths>` and the code at 3185dd4c (one reader per document group, each claim checked against the source), the fixes went in as 74049f01, and all 14 were restamped at 74049f01:
+
+- `README.md`: the acon inbox paragraph names questions and results and the person-gated manager ports; the Operations list names `hub_ask`/`ahub answer` and `ahub results`; the Upgrading paragraph says `ahub upgrade` names the CLI and plugin step (#1179); the report link points at this file.
+- `docs/quickstart.md`: install line `#v0.31.0`, the "Upgrading to 0.31.0" section, the upgrade-advice sentence, `ahub answer` and `ahub results` rows in the working-day table, and mark-read on the dashboard.
+- `docs/operations.md`: 0.31.0 in the header and the protocol table (protocol unchanged, 16 through 17), the N-1 paragraph (0.30.0 for 0.31.x), the 0.30.0 post-release note now published in the 0.31.0 section, the handoff synopsis `--key`, the `research_evidence` recovery label, `ahub upgrade` advice, the acon panel's own manager ports, the inbox contents and its 50-item bound, and the `ahub answer` synopsis.
+- `docs/security.md`: the acon plugin's reach (the `answer`, `receipt` and review ports), its confirmation list and inbox items; accepted channel-delivery settlement; conductor cancellation of handed-off tasks; the fourth handoff message, the key, sequence and `duplicate_ok` fields; dashboard question, result and review data; memory sync narrowing and `ahub memory declined`; `hub_evidence_record`; the 2.1.318 implementer receipt; the `liveTestRefusal` line; and a new "Anchored review comments (#1056)" section.
+- `docs/agent-notes/adapters.md`: the `acceptedSettlement` port (#1172) and the owned input observers (#1056).
+- `docs/agent-notes/budget.md`: transient `Bus.pause`/`resume` write no snapshot (#1214).
+- `docs/agent-notes/bus.md`: pushed vs pulled answer parents, review-observer telemetry suppression, owner-audience reviews never moot, explicit-channel `accepted` resolution, accepted-delivery expiry, review provenance and room delivery rows.
+- `docs/agent-notes/daemon.md`: the recovery floor list (`research_evidence`, `review_comments`, `review_observer_input_state`, `accepted_delivery_settlement`), the DOING privacy screens, review observer input, channel push evidence, the inbox project listing budget, held-hint rendering, memory sync policy outcomes and the retired pet window.
+- `docs/agent-notes/local-worker.md`: the review-turn exclusion (#1181, #1192).
+- `docs/agent-notes/tasks.md`: `Board.proposeHandoff`, `task_handoff_by_key`, sequence-ordered events and the periodic catch-up; claim evidence links; person review comments; long-term memory screening.
+- `docs/agent-notes/tests.md`: time-bounded waits (#1163), the fake-ripwire probe (#1197), channel parent evidence in fixtures (#1171) and the published fixtures' retarget rule (#1168).
+- No change needed: `src/cli/help.ts` (every form the 8 commits added matches `main.ts` and its parsers), `docs/agent-notes/README.md` and `docs/agent-notes/benchmarks.md` (each read; the commits in range do not change what they state).
+- Not acted on, outside the stale set: AGENTS.md "Area notes" does not yet name the new files `src/hub/review-comments.ts`, `review-anchor.ts`, `review-material.ts`, `research-evidence.ts`, `memory-sync-policy.ts`, `question-detach.ts`, `completion-detail.ts`, `memory-sync-state.ts`, `src/ui/plugin-questions.ts` and the new `src/cli/*-args.ts` parsers; `test/specs-tasks.test.ts` and `test/broker-server.test.ts` still bound a wait by event-loop turns.
+
+- Follow-up review of #1217: after #1218 merged, `check-docs --require-fresh` on main reported 12 documents stale by #1217 (and the #1218 merge). Each was re-read against #1217's diff only, the fixes went in as 142c80c7, and all 12 were restamped at 142c80c7:
+  - `README.md`: the Operations list names `ahub peer takeover`.
+  - `docs/operations.md`: the newest-hello sentence now applies only to a session that does not opt in to standby.
+  - `docs/security.md`: a paragraph on person-only takeover, standby fencing and display-only ids and PIDs.
+  - `docs/agent-notes/adapters.md`: the retained standby port (`retainStandby`, `takeover`, `ownsSocket`, closes 4405 and 4403).
+  - `docs/agent-notes/daemon.md`: the `peer_takeover` control message and detached-connection rule.
+  - `docs/agent-notes/tests.md`: close the fixture owner before attaching a second opted-in session.
+  - `src/cli/help.ts`: `ahub peer takeover` lists the `--json` and `--color` flags `main.ts` accepts.
+  - No change needed: `docs/agent-notes/README.md` (the `o` key acts on the selected row's displayed standby id, within the exact-row rule), `budget.md`, `bus.md`, `tasks.md` (#1217 changes no pause, queue or task path) and `docs/quickstart.md`.
+  - CHANGELOG: a #1217 entry under 0.31.0, and the N-1 statement names `peer_takeover`, `ahub peer takeover` and the standby opt-in in both directions.
+- Follow-up review of #1222: the merge of main left 9 documents stale by its `src/hub/bus.ts` and `src/rooms/link.ts` changes. Each was re-read against #1222's diff, the one fix went in as aceed883, and all 9 were restamped there:
+  - `docs/agent-notes/bus.md`: a closed `Bus` publishes nothing and touches no journal or observer.
+  - No change needed: `README.md`, `docs/operations.md`, `docs/security.md`, `docs/quickstart.md`, `budget.md`, `daemon.md`, `tasks.md`, `tests.md` (their presence and queue statements still hold; #1222 changes no surface, setting or wire field).
+  - CHANGELOG: a #1222 entry under 0.31.0; it changes no N-1 surface.
+
+## Checks
+
+- `node scripts/check-docs.mjs --require-fresh`: `docs: OK (0 stale documents)` after the restamp at 74049f01.
+- `scripts/check.sh --changed origin/main` on dgx02 (`remote_dev.py verify`) at e8f3a694 (tree a0576a8b) selected the full suite: `docs: OK (0 stale documents)`, `roles: OK`, `inventory: OK` (3267 entries, 1155 in the baseline), typecheck (`bun x tsc --noEmit`), the bundle check (`bun scripts/build.mjs --check`), `package: OK (791 files, @staix/agent-hub@0.31.0)`, and 11891 pass, 101 skip, 0 fail across 916 files with Bun 1.4.2; no daemon leaks; `check: OK`. It includes the published-runtime interoperability tests in both directions against 0.30.0 (release N-1) and 0.25.0 (protocol floor). Later commits on the release branch change only this report.
+- The release PR's exact-head CI on ubuntu and macOS is the gate for the merge.
+- Follow-up for #1217: `node scripts/check-docs.mjs --require-fresh` is `docs: OK (0 stale documents)` after the restamp at 142c80c7. `scripts/check.sh --changed origin/main` on dgx02 at 1acb9645 (tree e1a307e0) ran typecheck, the bundle check, `inventory: OK`, `package: OK (791 files, @staix/agent-hub@0.31.0)` and the 25 test files the change touches: 347 pass, 0 fail; `check: OK (changed)`. #1217's own full-suite and hosted CI receipts are in its PR. After that gate the branch merged main for #1222 (its own full dgx02 gate and hosted CI are in #1222) and added only documents, stamps and CHANGELOG lines; `check-docs --require-fresh` is clean at the final head. The follow-up PR's exact-head CI gates its merge, which must also be a merge commit.
+
+## Known gaps, not blocking
+
+- No installation, running-hub upgrade to 0.31.0 or live TUI launch was done for this record.
+- #1053: AC1 live receipts and the T1 timeout measurement stay open; the per-adapter `hub_ask` waits are provisional.
+- #1056 and #1204 (T3, T4) stay open; #1196 stays open until the person measures the live acon console.
+- #1173: complete bounded declined listings are available. Automatic v3 sync still lacks the supported activation and fresh host-attestation path in agent-mem#281.
+- #1184: the channel-evidence fallback reads the direct parent's process row; it is not authentication, and a published client opt-in is the upgrade path.
+- The N-1 fixture lock remains the Bun 1.4.2 lock for 0.30.0. Prior published-runtime interoperability evidence is recorded above; this documentation-only completion adds no new full-runtime claim.

package/docs/verification/2026-11-05-claude-implementer-2.1.318.md

@@ -0,0 +1,70 @@
+# Claude Code 2.1.318 headless implementer receipt
+
+Date: 2026-11-05. Scope: #888 (claude-implementer row). This repeats the procedures of the [2.1.316 receipt](2026-10-31-claude-implementer-2.1.316.md) on the installed Claude Code 2.1.318, with 2.1.316 run through the same producers as the control: the permission transport (Write, production-name Bash, Bash `updatedInput` rewrite) and the host shell wrapper. Source head: `801c6453`. Platform: macOS arm64, host Bun 1.4.3.
+
+Result: every case passed on both binaries. `2.1.318` is added to `COMPAT["claude-implementer"].verified`. 2.1.317 is installed but was not run and is not verified by this receipt.
+
+| Native version | Binary SHA-256 |
+| --- | --- |
+| Claude Code 2.1.316 (control) | `64c327e92b2c5e0f78c0a980c5a518121e1f0d140ca771ca5dd4488d1a2dcb3f` |
+| Claude Code 2.1.318 | `677a2ea7bf576cedd20e191d973914ed8a41796f53a63b1923381ddc4d5b5e7d` |
+
+The 2.1.316 hash matches the 2.1.316 receipt, so the control is the binary it certified.
+
+## Upstream changes since 2.1.316
+
+Read from the upstream [CHANGELOG](https://github.com/anthropics/claude-code/blob/main/CHANGELOG.md) entries for 2.1.317 and 2.1.318. Items that touch permissions, MCP, hooks, settings sources, process lifetime or the Bash tool:
+
+- **2.1.317, a check that asks before a web or shell tool call sends the account email address to the network**: a new ask. It fires only when a command carries the signed-in account's email; the model-free runs have no account, so this receipt does not exercise it. A real-account run that triggers it goes through the same permission prompt tool as any other ask.
+- **2.1.317, child processes of a stopped shell command sent SIGTERM twice**: fixed. The producers still require every native child's process group to be empty afterwards; this tightens cleanup and loosens nothing.
+- **2.1.317, edits to settings files in the first second after launch not taking effect** and **old transcripts not cleaned up for runs using `--setting-sources`**: fixed. The hub passes `--settings` with permission rules only before launch and an isolated `CLAUDE_CONFIG_DIR`, so neither changes the child's settings or permission inputs.
+- **2.1.317, `claude -p` exiting 0 when a full disk lost its transcript or `~/.claude.json` writes**: it now exits 1. That makes a storage failure visible as a failed turn, not a silent success.
+- **2.1.317, `claude -p` inside a cloud or self-hosted runner session sharing that session's ID** (`CLAUDE_CODE_DISABLE_NESTED_SESSION_ID`): the hub's implementer child is not started inside a runner session and gets the hub-built environment.
+- **2.1.318, stdio MCP servers that exit on the version probe re-probed on every start; a server that dies in under 3s is pinned to the legacy handshake for 7 days**: the implementer child's MCP server (`--strict-mcp-config`, the hub permission server) does not exit on the probe; the transport runs below still negotiate and answer on 2.1.318.
+- **2.1.318, a message sent right after a model change still running after Stop in headless sessions**: Stop now cancels it. The hub does not change models mid-turn in the implementer child.
+- **2.1.318, MCP tool errors**: a call made before the tool is loaded now returns its input schema. This changes error text only; the permission tool is loaded before the first tool call in every run below.
+- **2.1.318, unattended runs no longer rewrite `~/.claude.json` when nothing changed**, and a non-valid `~/.claude.json` now fails the start: the child runs with an isolated HOME and a fresh config.
+- **2.1.318, git commits and PR creation when the Bash tool runs macOS's `/bin/bash`**: reliability only; the wrapper's persistent-cwd control below still passes.
+
+Nothing in these entries changes `--permission-prompts host`, `--permission-prompt-tool`, `--strict-mcp-config`, `--setting-sources` or the `updatedInput` reply contract. This reading is of the changelog text, not the binary's source, which is not public.
+
+## Runs
+
+Each producer ran both binaries sequentially with an isolated HOME and `CLAUDE_CONFIG_DIR`, a fixture MCP server, a deterministic loopback provider and the literal API key `synthetic-probe-not-a-credential`. No account, provider request or model inference was involved. Every native child's process group was confirmed empty afterwards and every binary hash was unchanged.
+
+```sh
+python3 docs/verification/claude-permission-transport-native.py OUT/write --claude 2.1.316 --claude 2.1.318
+python3 docs/verification/claude-permission-transport-native.py OUT/bash --tool Bash --server-name agent-hub --permission-tool hub_permission_request --require-tool-use-id --claude ... --claude ...
+python3 docs/verification/claude-permission-transport-native.py OUT/rewrite --tool Bash --rewrite-bash --server-name agent-hub --permission-tool hub_permission_request --require-tool-use-id --claude ... --claude ...
+python3 docs/verification/claude-shell-wrapper-native.py OUT/wrapper --bun ABSOLUTE_BUN --claude ... --claude ...
+```
+
+(binary arguments are the absolute installed paths; `--bun` was the Homebrew Bun 1.4.3 path resolved with `readlink -f`, since `command -v bun` names a shell function in an interactive zsh).
+
+| Producer | Cases per binary | 2.1.316 | 2.1.318 |
+| --- | --- | --- | --- |
+| Write transport (allow, deny, missing tool, hook deny/allow, MCP error, disconnect, pending, deadline) | 9 | 9 pass | 9 pass |
+| Bash transport, production server and tool names, `tool_use_id` required | 9 | 9 pass | 9 pass |
+| Bash `updatedInput` command replacement (allow, deny) | 2 | 2 pass | 2 pass |
+| Host shell wrapper (persistent-cwd control, fixed-wrapper rewrite with replay refusal) | 2 | 2 pass | 2 pass |
+
+Per-case shapes on 2.1.318 match the control: pending stopped externally at the deadline; wrapper control 3 requests and 2 permission calls, wrapper rewrite 4 requests and 3 permission calls with the effect counter at exactly 1 after replay.
+
+The only producer change is the version allow-list in `claude-shell-wrapper-native.py`, which now admits `2.1.318`.
+
+| Artifact | SHA-256 |
+| --- | --- |
+| Permission producer (unchanged) | `8f8885f7153b3a236f3b3f8ce49a344b908f2af3b3aba8b064762d82d1ecf12a` |
+| Wrapper producer (this change) | `af61fcd08df7da42708226d73949646581d4b9d66d5c243de2c9d2c80afccb23` |
+| Wrapper host fixture (unchanged) | `616e6711e392f0eee7e3fa1c7bdc47a537dfa86bcc8ffb30e549ca94e5a71cef` |
+| Fixed CLI wrapper (unchanged) | `8ff56514a6e3f25bce0784775d396df199b58b1b93f55ad0e8747bbc729d2fd8` |
+| Write receipt JSON | `c0977198860c5a5141f7d49e8a52616aa4556b406975de8adb25f3ef1d0dbc52` |
+| Bash receipt JSON | `14a44372f3b44b32956aecd37e50836fb39f9a2847ad7b33e6185fb9784fac55` |
+| Rewrite receipt JSON | `ee3d66252006581a0481fe326313b674b1437d27b9adc8e617690c0efc45d3af` |
+| Wrapper receipt JSON | `2996280113526fd41a005a510656f47c0f20d4dba46d11611191238ed9576a4f` |
+
+The receipt JSON files stay in the local diagnostic directory; they carry local paths and are not committed.
+
+## Evidence boundaries
+
+Unchanged from the earlier receipts: no real provider authentication, model tool selection, person approval interaction, task-session resume or production-daemon task binding is proved, and this is not a runtime receipt gate. The 2.1.317 account-email ask is not exercised (no account). Native version admission and binary fencing remain required. The Monitor tool is still an unrewritten prompt-tool path. Exact-head package gate and CI are recorded on the PR.