@staix/agent-hub 0.32.0 → 0.33.0

package/docs/verification/2026-11-06-0.33.0.md

@@ -0,0 +1,222 @@
+# 0.33.0 release verification
+
+This record covers release preparation and source review. It claims no installation, no running-hub upgrade to 0.33.0 and no live TUI launch.
+
+## Candidate
+
+Version 0.33.0 was originally prepared from main `567b55be` (eight component commits since v0.32.0, one `feat`; bump rule: minor). Following the person's 2026-11-07 scope ruling, the release branch normally merged main `203d7a6da6b12bb38a0fd4743f736b9aa3d6a66d`, adding #1243 and #1244 for ten component PRs. The current candidate pins agent-mem 0.22.1 and includes the corrected activation copy. Earlier approval at `94f0a896` predates this rework and is not approval of the new candidate.
+
+## Reviews
+
+Component pull requests since v0.32.0: #1234, #1235, #1236, #1237, #1238, #1239, #1241, #1240, #1243 and #1244.
+
+All ten PRs merged after board approval. Fresh GitHub commit check-runs bind
+the macOS, Ubuntu and seeded-guard aggregates to each final PR head; all three
+aggregates succeeded. Skipped ancillary jobs are not test proof.
+
+| PR / task | Approved and final PR head | Merge commit | Hosted CI |
+| --- | --- | --- | --- |
+| [#1234](https://github.com/STAIxBWLB/agent-hub/pull/1234), task 747 | `65ab9bf7256f00ba6faf14da606c513e89899898` | `25878b3e66c80718f8512e0cfe5c05e4772853ec` | [19 success, 2 skipped](https://github.com/STAIxBWLB/agent-hub/actions/runs/42183963274) |
+| [#1235](https://github.com/STAIxBWLB/agent-hub/pull/1235), task 746 | `ca628faed478a0cce9a499ba8af562729871ab6b` | `1b99c2d264949d5f94b3c9ea08e5922002fc7159` | [19 success, 2 skipped](https://github.com/STAIxBWLB/agent-hub/actions/runs/42183799294) |
+| [#1236](https://github.com/STAIxBWLB/agent-hub/pull/1236), task 750 | `fe70149224154bd7f8f86f72cf7258c9ca5d3979` | `db8828031db6f9c49746187762df1e756f387d9a` | [19 success, 2 skipped](https://github.com/STAIxBWLB/agent-hub/actions/runs/42192573950) |
+| [#1237](https://github.com/STAIxBWLB/agent-hub/pull/1237), task 737 | `31a3e27db28e07d012e8a56b538acbfbf50e1874` | `73a4799662cbe416fc4b8f7c84aa7efc43646885` | [20 success, 2 skipped](https://github.com/STAIxBWLB/agent-hub/actions/runs/42211766399) |
+| [#1238](https://github.com/STAIxBWLB/agent-hub/pull/1238), task 748 | `e70f4edcfebf681b841343907d043c7cf8c39c18` | `d36c27c43237524df8939d36c2109b99cebe3003` | [20 success, 2 skipped](https://github.com/STAIxBWLB/agent-hub/actions/runs/42205240730) |
+| [#1239](https://github.com/STAIxBWLB/agent-hub/pull/1239), task 749 | `ff760ebf15fc0efe31ec4bc5db04733880d85de0` | `824a0b0f273dd47ac1acdfb70981584411464d3b` | [19 success, 2 skipped](https://github.com/STAIxBWLB/agent-hub/actions/runs/42217350346) |
+| [#1240](https://github.com/STAIxBWLB/agent-hub/pull/1240), task 751 | `31e5edd834d8516fa3edbb693f0c21c6cbedd8a1` | `567b55be96e82c5b4662a04657a0e810ac48d6e2` | [19 success, 2 skipped](https://github.com/STAIxBWLB/agent-hub/actions/runs/42221274665) |
+| [#1241](https://github.com/STAIxBWLB/agent-hub/pull/1241), task 753 | `668cd7a189d77bdc7db3285a8e679daa2a4fcd39` | `f193771aea0ba9f4b8e455ff28a58c13b2d9fb4b` | [19 success, 2 skipped](https://github.com/STAIxBWLB/agent-hub/actions/runs/42219293905) |
+| [#1243](https://github.com/STAIxBWLB/agent-hub/pull/1243), task 754 | `e877ca4f6f96c02a564ca1e0ba77e7f7fe57ca62` | `a20d4f389615fb98380d45969665b9f5beaec702` | [19 success, 2 skipped](https://github.com/STAIxBWLB/agent-hub/actions/runs/42251717050) |
+| [#1244](https://github.com/STAIxBWLB/agent-hub/pull/1244), task 755 | `f6971edf8980949eeb1c10f889a6c5f0c35b7e63` | `203d7a6da6b12bb38a0fd4743f736b9aa3d6a66d` | [19 success, 2 skipped](https://github.com/STAIxBWLB/agent-hub/actions/runs/42259392652) |
+
+The conductor integrated main into #1239 and #1240 without changing their scope.
+For #1239, the owner's earlier evidence head was `23a967fc4d0a289226ef295f389d8388f01b1340`;
+the owner then fast-forwarded and re-filed `ff760ebf15fc0efe31ec4bc5db04733880d85de0`,
+which received the final approval and CI. For #1240, an earlier approval bound
+`a1ef48c8af43de1e782d024c3310d28e704b7651`; the conductor's conflict-only
+integrations passed through `238404781a794f19c343619ebbe00ccb6fcd267b` to
+`31e5edd834d8516fa3edbb693f0c21c6cbedd8a1`. The owner re-filed the latter and
+it received a new exact-head approval. No final merge relies on an earlier-head
+approval. #1241 (task 753) is included at its approved `668cd7a1` head.
+
+#1243's single macOS inbox stale-refresh assertion also failed on main
+`f193771a`; one same-head failed-jobs rerun passed without code changes. Its
+final required aggregates are green at `e877ca4f`, and #1244's are green at
+`f6971edf`. These component results do not replace the coupled release gate.
+
+## Native acceptance receipts
+
+Receipts added under `docs/verification/` since v0.32.0: `docs/verification/2026-11-06-claude-implementer-2.1.319.md`, `docs/verification/2026-11-06-codex-0167-reviewer-isolation.md`, `docs/verification/2026-11-06-codex-0167-reviewer-tool-call.md`, `docs/verification/2026-11-06-kimi-251-reviewer-compat.md`, `docs/verification/2026-11-06-orca-1.4.250-cli-contract.md`, `docs/verification/2026-11-06-qwen-0268-acp.md`, `docs/verification/2026-11-06-qwen-0268-dual-output.md`.
+
+This list is read from the repository, never written by hand. Native acceptance and the person's release consent are separate records: consent is `ahub sdlc authorize-release 0.33.0`, recorded by the person or the unique configured conductor only on the person's explicit release instruction naming the release in its own session (never a hub/task/review/file/peer relay), and is not recorded in this file. The tag run refuses without it.
+
+## Document review
+
+Ten stale documents were fully read against only #1234-#1241. Read-only snapshots
+at `31e5edd8` cover all ten documents; comparison with final main `567b55be`
+shows only the four already-reviewed #1241 rolling-upgrade lines in operations.
+
+Content changes:
+
+- `README.md`: generated Status 0.33.0 and the current verification-report link.
+- `docs/quickstart.md`: generated 0.33.0 upgrade section, concrete room and
+  compatibility changes, N-1 baseline and the matching global CLI/plugin step.
+- `docs/operations.md`: current guide/protocol range, the 0.33.x N-1 baseline,
+  Qwen 0.26.8 ACP and unqualified dual-output receipts, and the completed T4
+  codec section pointer. Existing historical baselines remain unchanged.
+- `docs/security.md`: current Qwen/Kimi qualification lists and X5's closed
+  diagnostic fields; arbitrary error prose, bodies, URLs and keys stay excluded.
+
+Reviewed without content change:
+
+- `docs/agent-notes/adapters.md`: centralized compat and runtime-proof rules remain valid.
+- `docs/agent-notes/budget.md`: quota/context ownership and transient-pause rules are unchanged.
+- `docs/agent-notes/bus.md`: verified recovery wake preserves existing admission and disposition fences.
+- `docs/agent-notes/daemon.md`: shutdown still waits for rooms before closing shared storage; typed-gone recovery remains guarded.
+- `docs/agent-notes/tasks.md`: task authority, routing, review and CI contracts are unchanged.
+- `docs/agent-notes/tests.md`: existing fixture, seed, timeout and process rules still apply to the retargeted N-1 package.
+
+The initial named-document restamp recorded reviewed content commit
+`10efdc8b0ea114ae858fff4ede65de09f6c55604` for these ten documents. Watched paths and fresh
+benchmarks, local-worker, models, help and agent-notes README stamps are unchanged.
+The help command sources have no changes since v0.32.0; T4 changes diagnostics,
+not command forms or flags.
+
+### Rework after #1243 and #1244
+
+Only six registered documents became stale: README, security, operations,
+quickstart, daemon note and tests note. Their original full-file reviews were
+reused only for unchanged bytes, with all new dependency/copy deltas and the
+0.22.x official N-1 contract reviewed. Current-copy corrections are limited to
+the new core pin, available native activation versus missing host attestation,
+and shared-home compatibility; historical release baselines remain intact.
+The daemon/tests notes remain byte-identical and require no instruction change.
+
+Those six named documents are restamped at reviewed rework content commit
+`ab8ae6f400d741ee9060d3087489e59996a72086`. Adapters, budget, bus and tasks notes retain their
+initial reviewed stamps; other fresh stamps and all watched paths are unchanged.
+`docs/memory.md` carries #1244's reviewed 0.22.1 activation/attestation text but is
+not registered in the stamp manifest, so no stamp or new watch scope is invented.
+
+## Initial candidate checks (historical)
+
+The official generator was dry-run first, then applied from exact main
+`567b55be96e82c5b4662a04657a0e810ac48d6e2` on branch `release/0.33.0` in
+a dgx02 checkout, using frozen root dependencies and pinned Bun 1.4.2. Only the
+existing published v0.32.0 tag was fetched. The separate fixture lock was then
+generated by Bun 1.4.2. Only the planned committed text artifacts returned;
+no dependency tree or other build directory returned.
+
+Producer SHA-256:
+
+- Bundle: `94532d16e1380743e6a2dd08abe5aeab30d211ad893d56f3ea5d00982dd2234c`.
+- Plugin manifest: `9705bfe5fd9320eefcf8ef1bc6a1bbabdfac85c121a09102ec4e82869904355a`.
+- N-1 lock: `9926687c74cdc12aead17a6ff66cc29e762f4e2dff83bda9cf2309f07769f8c3`.
+
+npm confirms 0.32.0 is the latest published 0.32.x patch, with exact agent-mem
+0.21.0. Its registry integrity matches the fixture lock. Protocol floor 0.25.0
+is unchanged. The new N-1 prose distinguishes old `ahub room status` filtering
+from generic `ahub status --json`, which passes raw daemon fields through.
+
+At committed `d1f01f676ce9a940119b050d52467b7d1b5b682c`, dgx02 first passed
+`node scripts/check-docs.mjs --require-fresh --committed`, frozen root and both
+published-fixture installs, then the published protocol/plugin and broker tests:
+28 pass, 0 fail, 175 assertions across two files in 4.78 seconds. The control/plugin
+legs are bidirectional and retain the existing synthetic native-parent-row
+observation; they are not a real Claude launch or account receipt. The room cases
+load an unchanged published 0.32.0 member against the current broker and current
+links against the published 0.32.0 broker. Their ordinary current-to-old chat,
+legacy presence and ephemeral/liveness observations supplement the unchanged
+v1-codec source comparison; they do not establish live two-machine behavior.
+
+The same exact-head run then executed `scripts/check.sh --changed`. Package and
+fixture changes selected the full suite:
+
+```text
+ 12073 pass
+ 101 skip
+ 0 fail
+ 312186 expect() calls
+Ran 12174 tests across 938 files. [2048.93s]
+check: no current-invocation agent-hub daemon leaks
+check: OK
+remote_dev: verify dev/agent-hub/.worktrees/release-0.33.0 d1f01f676ce9 exit 0 in 2092s
+```
+
+Typecheck, roles, inventory (3293 entries, 2288 classified, 1005 unchanged baseline
+keys), bundle freshness and package contents passed. Documentation had 0 stale
+documents. Total wall time includes the focused leg and setup above.
+
+This following report-only commit records the completed result; it does not
+inherit a new full-suite claim for itself. Final-head documentation/delta checks
+and hosted CI are recorded in the release PR. Exact-head hosted CI remains the
+merge gate, not a claim inherited from this runtime head or a component PR.
+
+## Rework checks
+
+After normally integrating main `203d7a6d`, pinned Bun 1.4.2 regenerated the
+0.33.0 bundle with core 0.22.1 on dgx02. Current bundle SHA-256 is
+`009b624ca203e3c34243b480bf79c5feb9b1e84053709f8523c306bdda0fa620`;
+plugin manifest and N-1 lock hashes remain those above. The fixture still uses
+published 0.32.0/core 0.21.0; protocol floor 0.25.0 is unchanged.
+
+At exact committed candidate `ebf139b7288517a34059259676709dbe66558ee5`, dgx02
+passed committed documentation freshness, frozen root/protocol-floor/N-1 installs,
+and the focused published-protocol, broker/member and placement-health files.
+The same run then executed `scripts/check.sh --changed`, which selected the
+full suite with current core 0.22.1 and published N-1 core 0.21.0:
+
+```text
+ 12073 pass
+ 101 skip
+ 0 fail
+ 312186 expect() calls
+Ran 12174 tests across 938 files. [2048.37s]
+check: no current-invocation agent-hub daemon leaks
+check: OK
+remote_dev: verify dev/agent-hub/.worktrees/release-0.33.0 ebf139b72885 exit 0 in 2085s
+```
+
+Documentation had 0 stale entries. Typecheck, roles, inventory, bundle freshness
+and package contents passed. This is new coupled evidence, separate from the
+initial candidate and component PRs. The following documentation-only commit
+records these results and clarifies the conditional old-reader sentence and
+table formatting; it does not inherit a new full-suite claim. Final-head
+documentation/delta checks and exact-head hosted CI are recorded in the PR,
+and hosted CI remains the merge gate.
+
+## Shared-home N-1 boundary
+
+The current hub pins core 0.22.1; published hub 0.32.0 pins 0.21.0. Core 0.22.x's
+own N-1 statement preserves curated, capture, hook-spool, candidates, work-list
+and setup-receipt formats, `INDEX_VERSION` and the index filename. Shared-v1,
+generation and v1/v2 shard sync are unchanged, and inactive homes behave as before.
+Placement activation and writer renewal are opt-in person commands. If renewal
+history is present, the old 0.21.0 closed journal reader refuses that history
+and placement publication before effects. This is not a promise of compatibility after arbitrary person
+operations. Shared-home coordination remains the person's separate operation
+after release; preparation performs no activation, renewal or floor change.
+
+## Known gaps, not blocking
+
+- This preparation makes no installation, running-hub upgrade, native/model call,
+  real-account, live TLS/proxy or two-machine acceptance claim. Published-package
+  control/plugin and isolated broker/member fixtures are separate evidence.
+- The Claude 2.1.319, Kimi 2.5.1 and Qwen ACP 0.26.8 receipts are model-free.
+  Codex 0.167.0's single authorized attempt ended at harness readiness before
+  verdict readback: its outcome is unknown, not a proven model failure, no retry
+  occurred, and the version stays unverified. Qwen dual-output 0.26.8 is not
+  qualified; the verified dual-output version remains 0.26.1.
+- Mixed room upgrades keep plain chat, but a 0.33.0 feature-required send to a
+  released member or through a released broker refuses before effects. Upgrade
+  broker, members, reconnect. Signed codec observations are compatibility only,
+  not privacy, permission, task or native authority.
+- #1204's AC1-AC8 in-process acceptance audit was approved and the issue is closed.
+  Receiver dedupe retains its documented 30-day / 10,000-identity ceiling; removed
+  operator gap notices do not relax permanent replay floors.
+- Agent-mem is now 0.22.1 via #1243, and #1244 accurately names the available
+  person-only activation preview. Default-host active-v3 sync still lacks fresh
+  placement-attestation integration (#1173); activation alone does not enable it.
+  No home activation, writer renewal or floor mutation occurs here.
+- Other person/account-dependent gates remain in the smoke ledger. This task
+  performs no merge, tag, publication or release-consent write. The conductor's
+  release merge must preserve these stamps with a merge commit and the default
+  subject; the person's tag decision is separate.

package/docs/verification/2026-11-06-claude-implementer-2.1.319.md

@@ -0,0 +1,57 @@
+# Claude Code 2.1.319 headless implementer receipt
+
+Date: 2026-11-06. Scope: #888 (claude-implementer row), hub task #750. This repeats the procedures of the [2.1.318 receipt](2026-11-05-claude-implementer-2.1.318.md) on the installed Claude Code 2.1.319, with 2.1.318 run through the same producers as the control: the permission transport (Write, production-name Bash, Bash `updatedInput` rewrite) and the host shell wrapper. Source base: `f7cbefda` (0.32.0). Platform: macOS arm64, host Bun 1.4.3.
+
+Result: every case passed on both binaries. `2.1.319` is added to `COMPAT["claude-implementer"].verified`.
+
+| Native version | Binary SHA-256 |
+| --- | --- |
+| Claude Code 2.1.318 (control) | `677a2ea7bf576cedd20e191d973914ed8a41796f53a63b1923381ddc4d5b5e7d` |
+| Claude Code 2.1.319 | `1f53587e92dee8e089fa349188a4cda64fa34ace6e7b0ca2ee278ddaa3cc2ebd` |
+
+The 2.1.318 hash matches the 2.1.318 receipt, so the control is the binary it certified.
+
+## Upstream changes since 2.1.318
+
+None to read: the upstream [CHANGELOG](https://github.com/anthropics/claude-code/blob/main/CHANGELOG.md) had no 2.1.319 entry when this was checked (its newest heading was 2.1.318), and npm `@anthropic-ai/claude-code` latest was still 2.1.318. 2.1.319 reached this machine through the native installer. This receipt therefore rests on observed behavior only, with no changelog reading.
+
+## Runs
+
+Each producer ran both binaries sequentially with an isolated HOME and `CLAUDE_CONFIG_DIR`, a fixture MCP server, a deterministic loopback provider and the literal API key `synthetic-probe-not-a-credential`, from a shell with the hub's agent markers (`AGENTHUB_HOME`, `AGENTHUB_PEER_ID`, `CLAUDECODE`, `CLAUDE_CODE_SESSION_ID`) unset. No account, provider request or model inference was involved. Every native child's process group was confirmed empty afterwards, and both binary hashes were the same before and after.
+
+```sh
+python3 docs/verification/claude-permission-transport-native.py OUT/write --claude 2.1.318 --claude 2.1.319
+python3 docs/verification/claude-permission-transport-native.py OUT/bash --tool Bash --server-name agent-hub --permission-tool hub_permission_request --require-tool-use-id --claude ... --claude ...
+python3 docs/verification/claude-permission-transport-native.py OUT/rewrite --tool Bash --rewrite-bash --server-name agent-hub --permission-tool hub_permission_request --require-tool-use-id --claude ... --claude ...
+python3 docs/verification/claude-shell-wrapper-native.py OUT/wrapper --bun ABSOLUTE_BUN --claude ... --claude ...
+```
+
+(binary arguments are the absolute installed paths under `~/.local/share/claude/versions/`; `--bun` was the Homebrew Bun 1.4.3 path resolved with `readlink -f`).
+
+| Producer | Cases per binary | 2.1.318 | 2.1.319 |
+| --- | --- | --- | --- |
+| Write transport (allow, deny, missing tool, hook deny/allow, MCP error, disconnect, pending, deadline) | 9 | 9 pass | 9 pass |
+| Bash transport, production server and tool names, `tool_use_id` required | 9 | 9 pass | 9 pass |
+| Bash `updatedInput` command replacement (allow, deny) | 2 | 2 pass | 2 pass |
+| Host shell wrapper (persistent-cwd control, fixed-wrapper rewrite with replay refusal) | 2 | 2 pass | 2 pass |
+
+Per-case shapes on 2.1.319 match the control: pending stopped externally at the deadline; wrapper control 3 requests and 2 permission calls, wrapper rewrite 4 requests and 3 permission calls with the effect counter at exactly 1 after replay.
+
+The only producer change is the version allow-list in `claude-shell-wrapper-native.py`, which now admits `2.1.319`.
+
+| Artifact | SHA-256 |
+| --- | --- |
+| Permission producer (unchanged) | `8f8885f7153b3a236f3b3f8ce49a344b908f2af3b3aba8b064762d82d1ecf12a` |
+| Wrapper producer (this change) | `ce4b9fdd06e393656155a3bd767e899a445abaec4313d832f1a4a519a42c155d` |
+| Wrapper host fixture (unchanged) | `616e6711e392f0eee7e3fa1c7bdc47a537dfa86bcc8ffb30e549ca94e5a71cef` |
+| Fixed CLI wrapper (unchanged) | `8ff56514a6e3f25bce0784775d396df199b58b1b93f55ad0e8747bbc729d2fd8` |
+| Write receipt JSON | `ed55c32bb86de8326251c63250b3bb90138e299558822f57fba19cb97231ddfb` |
+| Bash receipt JSON | `a07501001835a7bcfb90bd4f6f546eb1e358bcad4be79b0e5b7f7d9b7c3d9e2d` |
+| Rewrite receipt JSON | `1e3364f4925e098d34d9b7245a1b93bdd7815cb6d3e23138de2c25c7cede6238` |
+| Wrapper receipt JSON | `f1708b427ae166cfc95e33e6c1c2ffc7d57acfae04cc6e2f394c9249292cab16` |
+
+The receipt JSON files stay in the local diagnostic directory; they carry local paths and are not committed.
+
+## Evidence boundaries
+
+Unchanged from the earlier receipts: no real provider authentication, model tool selection, person approval interaction, task-session resume or production-daemon task binding is proved, and this is not a runtime receipt gate. With no public changelog for 2.1.319, a behavior change outside these producers' cases would not be seen here. Native version admission and binary fencing remain required. The Monitor tool is still an unrewritten prompt-tool path. Exact-head package gate and CI are recorded on the PR.

package/docs/verification/2026-11-06-codex-0167-reviewer-isolation.md

@@ -0,0 +1,56 @@
+# Codex 0.167.0 fresh-reviewer isolation receipt
+
+Date: 2026-11-06. Platform: macOS arm64, Bun 1.4.3. Scope: issue #888, task 747. This repeats the [0.166.0 model-free production preparation](2026-10-31-codex-0166-reviewer-isolation.md) with 0.166.0 as the control. Source base: `f7cbefda` (0.32.0 on main). No `codex exec`, model request, login, credential copy or live reviewer run was performed. The returned launch was inspected, never started. The person's real HOME, `~/.codex`, the Orca codex account home and the global Codex install were never supplied to a Codex process or modified.
+
+Result: all four model-free legs returned the expected outcome. 0.167.0 passed the model-free procedure and joins the verified reviewer set after the separately authorized model-backed run. This receipt does not add it, because `docs/agent-notes/adapters.md` requires a successful model-backed hub tool call before a reviewer version is marked verified (0.166.0 was reverted once for the same reason). That single run (the [2026-11-02 receipt](2026-11-02-codex-0166-reviewer-tool-call.md) is the 0.166.0 precedent) needs the person's separate authorization and was not run. It is unverified for 0.167.0, as is everything a model turn would show (tool selection, verdict delivery, the synthetic marker readback, real account authentication). Until then the person can run `ahub agents trust codex-review 0.167.0`, and every runtime proof still runs.
+
+## Source identity and re-read regions
+
+`git ls-remote https://github.com/openai/codex.git` returned, for 0.167.0, annotated tag object `cb41599ccbe371272892f156286a236aa097bada` and peeled commit `086ccc833bc9cf01024ad2dd6af7dbd421b6bf9a`. The same readback returned the 0.166.0 tag object `593389380740f7b4762771573c447ccfdc59742f` and peeled commit `6ff1e1ca3b30fc8b914720681fcf5fe62e95f856`, matching its receipt.
+
+Each of the seven files read for 0.166.0 was fetched at both peeled commits and compared by SHA-256 and by diff. Five are byte-identical between the tags: `exec/src/cli.rs`, `config/src/mcp_types.rs`, `core/src/mcp.rs`, `hooks/src/registry.rs` and `sandboxing/src/seatbelt.rs`. Two changed, `core/src/session/mod.rs` and `core-plugins/src/manager.rs`, and were read at their new anchors.
+
+- [Exec switches, lines 40-50](https://github.com/openai/codex/blob/086ccc833bc9cf01024ad2dd6af7dbd421b6bf9a/codex-rs/exec/src/cli.rs#L40): identical. `--ephemeral`, `--ignore-user-config` and `--ignore-rules` remain independent global switches, and auth still uses `CODEX_HOME`.
+- [Apps projection, lines 279-285](https://github.com/openai/codex/blob/086ccc833bc9cf01024ad2dd6af7dbd421b6bf9a/codex-rs/core/src/mcp.rs#L279) and [registration, lines 464-485](https://github.com/openai/codex/blob/086ccc833bc9cf01024ad2dd6af7dbd421b6bf9a/codex-rs/core/src/mcp.rs#L464): identical. Disabling MCP servers clears the Apps gate, and implicit Apps registration still needs Apps enabled and a non-isolated session. Configured inventory alone still cannot prove the runtime server absent, so effective feature readback stays required.
+- [MCP schema, lines 243-245](https://github.com/openai/codex/blob/086ccc833bc9cf01024ad2dd6af7dbd421b6bf9a/codex-rs/config/src/mcp_types.rs#L243) and [291-297](https://github.com/openai/codex/blob/086ccc833bc9cf01024ad2dd6af7dbd421b6bf9a/codex-rs/config/src/mcp_types.rs#L291): identical. A disabled server is not initialized; `enabled_tools` restricts, `disabled_tools` filters afterwards.
+- [Registry, lines 179-197](https://github.com/openai/codex/blob/086ccc833bc9cf01024ad2dd6af7dbd421b6bf9a/codex-rs/hooks/src/registry.rs#L179): identical. A non-empty legacy notify argv still becomes an after-agent hook independently of the hooks feature flag.
+- [Session hook configuration, now line 5822](https://github.com/openai/codex/blob/086ccc833bc9cf01024ad2dd6af7dbd421b6bf9a/codex-rs/core/src/session/mod.rs#L5822) (was 5736) and the [session-static comment, now lines 2407-2410](https://github.com/openai/codex/blob/086ccc833bc9cf01024ad2dd6af7dbd421b6bf9a/codex-rs/core/src/session/mod.rs#L2407) (was 2389-2392): `session/mod.rs` changed (5756 to 5842 lines). The diff was read in full for the regions that matter here. `legacy_notify_argv: config.notify.clone()` is unchanged, and the comment still says legacy notify settings remain session-static. The other hunks are an `inject` visibility change, a `PendingApproval` import, a `NetworkApprovalTurn` enum, token-estimate and sampling bookkeeping, queued network approval holding, and an exec policy manager now built `from_snapshot` with its source requirements. None touches notify, hooks, Apps gating or isolated-session metadata. The host therefore still pins `notify=[]` for the metadata proofs and the returned exec argv.
+- [Plugin manager, now lines 836-841](https://github.com/openai/codex/blob/086ccc833bc9cf01024ad2dd6af7dbd421b6bf9a/codex-rs/core-plugins/src/manager.rs#L836) (was 831-834): `manager.rs` changed (3793 to 3800 lines). The plugin-disabled early return of the default load outcome is unchanged. The one hunk, near line 665, clears per-plugin Apps policy before building the plugin load input, which does not change the disabled-plugins path.
+- [Seatbelt glob compiler, lines 624-705](https://github.com/openai/codex/blob/086ccc833bc9cf01024ad2dd6af7dbd421b6bf9a/codex-rs/sandboxing/src/seatbelt.rs#L624): identical, so the anchored read/write denies, static-prefix variants and ancestor unlink denies are the same code.
+
+## Native production preparation
+
+A throwaway producer outside the source checkout, in a private scratch directory, invoked the actual `codexReviewerBackend.prepare` from a clean worktree of main plus this change, with the frozen install's exact `@staix/agent-mem@0.21.0`. Each leg used its own fresh root holding project, HOME, CODEX_HOME and TMPDIR. The child ran under `env -i` with only PATH, LANG, HOME, CODEX_HOME, TMPDIR and two fixture markers. Before importing the backend, it rejected any extra variable, a `os.homedir()` that differed from HOME, and any home, CODEX_HOME or temp directory outside the root. The MCP transport was inert `/usr/bin/false` with no control token, and the private paths were `**/*.env`, `.private`, `nested/secret` and `~/private-proof`.
+
+Both Codex versions were installed with `npm install --prefix` into separate private prefixes, with scratch HOME and cache and empty user and global npm configs. The command was each prefix's `codex.js` launcher, resolved by production to its native arm64 binary. Temporary roots and canaries were removed after each leg, and the returned exec launch was never executed.
+
+| Leg | Outcome | Elapsed |
+| --- | --- | --- |
+| Before compat edit, 0.167.0, empty homes | Refused only at version admission, `causeClass: version`; previous verified set 0.146.0, 0.163.0, 0.164.0, 0.166.0 | 160.67 ms |
+| With 0.167.0 provisionally in the local verified array (a stand-in for the person's machine trust), empty homes | All production preparation legs pass | 261.26 ms |
+| Same provisional entry, synthetic ambient config | All production preparation legs pass | 261.83 ms |
+| Control 0.166.0, empty homes (run before the edit) | All production preparation legs pass | 302.52 ms |
+| Control 0.166.0, synthetic ambient config (run after the edit) | All production preparation legs pass | 252.46 ms |
+
+The ambient file enabled Apps, plugins and hooks, set a legacy notify command and declared one stdio and one HTTP MCP server. Metadata preparation disabled the ambient servers, kept only the hub server with exactly `hub_review` and `hub_task_show`, and proved effective Apps, plugins and hooks disablement. Per-tool approval stays configured only for those two hub tools; actual MCP tool execution is outside this receipt.
+
+| Version | Native binary SHA-256 | Production binary identity |
+| --- | --- | --- |
+| 0.167.0 | `030316ecfbb41f4e7946e584b0063ef333b7a36cd312ba349f2f6869e39b62cc` | `sha256:213f7a2c8109c5f5158151b829bfc561bc76bbcdcce0b641c1e9a01b8b541e37` |
+| 0.166.0 (control) | `39acf979729dd290f9a24ee38b2914e036c91b65952872e28ae2a6b88a7db7c1` | `sha256:77c2eae1013cec5acaa8a2d980bb760a7ca7657ebb9cb3033550cad787ab2fdd` |
+
+The control's native digest and production identity equal the values in the 0.166.0 receipt, so the procedure reproduces. Every successful launch returned `backend: codex`, `readOnly: true`, `strictMcp: true`, `ephemeral: true`, `current(): true`, an exec argv beginning `exec` and an explicit `-c notify=[]`. The evidence list was identical across all four successful launches and equal to the 0.166.0 list: `model-free-mcp-inventory-disabled-ambient`, `hub-tools-exact-allowlist`, `plugins-and-hooks-disabled`, `legacy-notify-disabled`, `apps-disabled-effective-feature-readback`, `web-search-disabled`, `project-untrusted`, `native-public-read-private-deny-write-deny`, `native-glob-and-symlink-private-deny`, `portable-core-name-and-state-deny`, `standard-host-credential-roots-denied`, `binary-config-stable`, `binary-hash-once-metadata-fence`, `session-ephemeral`.
+
+Production's own native canaries passed for 0.167.0: public read, denied exact private read, denied nested private glob and symlink alias, denied portable-core `.env` and `.agenthub/state`, denied synthetic gh, kube and docker credential roots and credential alias, and denied creation of a new file with the file remaining absent. Production's metadata commands kept their 2-second command and 12-second overall limits and owned-group cleanup; none failed.
+
+## Compatibility and evidence boundaries
+
+The verified reviewer versions stay 0.146.0, 0.163.0, 0.164.0 and 0.166.0. 0.167.0 is not added: the area note requires the model-backed hub tool call first, and a connector review on the first revision of this PR correctly flagged that I had added it. The two passing 0.167.0 legs above ran with 0.167.0 in a local, uncommitted copy of the verified array, which is the same admission outcome the person's `ahub agents trust codex-review 0.167.0` produces, since trust lifts only the version pin and every proof still runs. The committed tree refuses 0.167.0 at version admission, as the first leg showed. 0.165.0 stays unverified. The attached Codex adapter's capability pins (`NATIVE_PINS.codex`, still 0.166.0) are a separate contract and unchanged. No isolation implementation, sandbox ceiling or trust bypass changes. The compat receipt pointer names this receipt. `docs/verified.json` is not restamped.
+
+Unverified for 0.167.0: the single model-backed tool-call run (marker, head, verdict and cleanup readback), which needs the person's separate authorization; exec selecting the named default profile; model tool selection; real account authentication; and effective web-search mode. The network setting is configured disabled without a separate probe. No native Linux result is claimed. Same-user mutation after the final metadata check is outside atomic snapshot guarantees, and the bounded credential-root list is not a classifier for every private host file.
+
+Source claims apply to the two peeled commits only. Each upgrade repeats the procedure; the throwaway producer is not a supported command and its raw records carry temporary paths, so they stay outside git. The changed-source gate on dgx02 and exact-head hosted CI are separate evidence recorded on the PR.
+
+## Separately authorized model-backed attempt
+
+The [2026-11-06 single tool-call attempt](2026-11-06-codex-0167-reviewer-tool-call.md) passed native startup isolation and the rendered accepted-plan marker precondition, then failed the harness readiness/readback leg before a complete persisted verdict/head/marker result was recorded. Its one-attempt fence was consumed once; no retry was made. The model/tool outcome remains unknown, not a proven missing verdict. This does not qualify 0.167.0, and the verified set remains unchanged.

package/docs/verification/2026-11-06-codex-0167-reviewer-tool-call.md

@@ -0,0 +1,66 @@
+# Codex 0.167.0 single reviewer tool-call attempt, not qualified
+
+Date: 2026-11-06. Scope: issue #888, task #751. This records exactly one newly authorized native reviewer attempt after the [0.167.0 model-free receipt](2026-11-06-codex-0167-reviewer-isolation.md), following the corrected [0.166.0 procedure](2026-11-02-codex-0166-reviewer-tool-call.md).
+
+**Result: qualification failed at the harness readiness/readback leg.** Native startup isolation and the accepted-plan marker precondition passed. The one-attempt fence was consumed once. The harness then reported `fixture readiness deadline` before it emitted `verdict-readback`. No complete persisted verdict/head/marker result was recorded, so the model/tool outcome remains unknown. This is not proof that the model failed to call a tool or that no verdict existed. No retry was made, and 0.167.0 stays outside `COMPAT["codex-review"].verified`.
+
+## Bound procedure and model-free preflight
+
+The source worktree branched from merged PR #1234 at `25878b3e66c80718f8512e0cfe5c05e4772853ec`. The retained task #625 controller and driver were copied only into a new private task directory. Adaptations changed the source path, task labels/environment prefix and exact native version from 0.166.0 to 0.167.0; the original consumed fence was not touched. The new task used its own persistent exclusive `wx` fence.
+
+The worktree had its own frozen dependency installation, exact `@staix/agent-mem@0.21.0`, and pinned Bun 1.4.2. The Mac native exception was admitted through `dot admit`, with normal memory, thermal state 0, about 87% CPU idle and no competing local admission owner. The global Bun executable was not changed.
+
+`--prepare` bound the installed exact 0.167.0 package and parsed the private driver without reading credential values. The setup-only rehearsal passed with zero native preparations and zero model requests, no auth symlink and no consumed fence. It created production daemon state only in fresh temporary homes, confirmed source/auth metadata stability and removed its temporary state. The current-source dgx02 model-free regression run passed 91 tests, 0 failed, 617 assertions across `review-scope`, `codex-review-isolation` and `compat` at that source head. This includes accepted-plan envelope coverage; it is not a native model result.
+
+The controller held the repository lock before creating fresh HOME, CODEX_HOME and TMPDIR. Actual mode created one auth symlink to the configured account, used eighteen bounded original credential roots in private paths and granted version admission only in the temporary hub home. It did not change machine trust or the real configuration. No account path, credential value, private marker value or model prose is included here.
+
+## One attempt and observed boundaries
+
+The native fixture uses production `startDaemon`, `ReviewerPrintPeer`, `codexReviewerBackend`, the stdio plugin and `Tasks`. A synthetic builder proposed and accepted an arithmetic task with the marker in one accepted `plan.risks` item. The wrapper verified the actual rendered review envelope contained that marker before opening the one-attempt fence and before calling the original `ReviewerPrintPeer.review`. It neither called `hub_review` on the model's behalf nor substituted a verdict.
+
+| Evidence | Observed |
+| --- | --- |
+| Source head | `25878b3e66c80718f8512e0cfe5c05e4772853ec` |
+| Platform / Bun / memory core | macOS arm64 / 1.4.2 / 0.21.0 |
+| Native startup reviewer | actual `ReviewerPrintPeer`, Codex 0.167.0 |
+| Startup binary identity | `sha256:213f7a2c8109c5f5158151b829bfc561bc76bbcdcce0b641c1e9a01b8b541e37` |
+| Startup isolation profile | `sha256:b0a4c1f0de7363e689a41056ec2ce21e5f0cead04399e1f8590c4cc1bc635af1` |
+| Backend source SHA-256 | `8e6ce4e64c6787a81e48a97172d25bbf1876ae5bc24a54934e7a107075a72214` |
+| Stdio plugin SHA-256 | `4c2b052a198b78a2162d410e8908e6501769632fcaa522ed88ee15a3a967dc88` |
+| Startup `readOnly`, `strictMcp`, `ephemeral` | all true |
+| Startup model-free evidence markers | all 14 present |
+| Actual envelope marker / summary withholding | present / review-only summary withheld |
+| Original review entries / fence consumptions | 1 / 1 |
+| Fixture start, UTC | `2026-11-06T09:05:41.828Z` |
+| Original review entered, UTC | `2026-11-06T09:05:42.679Z` |
+| Failed readiness check, UTC | `2026-11-06T09:06:10.455Z` |
+| Recorded cause | harness `fixture readiness deadline` |
+| Persisted state, reviewer and verdict count readback | unknown, no `verdict-readback` event |
+| Verdict head binding and marker match | unknown, not recorded |
+| Actual model tool-call result / turn isolation readback | unknown, not recorded |
+
+The failure event retained a stale phase label `reviewer-start`; that label is not used to attribute a native startup failure, because startup had already succeeded and `model-review-requested` was recorded. The private harness has bounded task/delivery readiness and reviewer-idle waits after that request. The preserved generic deadline does not identify a model/tool failure. Its fixed 110-second fixture and 120-second controller limits were not increased.
+
+The startup receipt retained the exact two-tool MCP allowlist, Apps/plugins/hooks disablement, legacy notify disablement, public/private/glob/symlink/credential and write-denial canaries, binary/config fences and ephemeral-session evidence. These are startup model-free observations. No post-turn isolation receipt was emitted, and effective model-turn network or web-search behavior is not inferred.
+
+## Cleanup and decision
+
+Production daemon stop and owned-group teardown were awaited; the controller confirmed its driver group was gone and released only its inode/owner-bound repository lock. Before cleanup, the synthetic source was unchanged and the original account auth metadata matched. The auth symlink, fake homes, source project, task state and temporary directory were removed. A later bounded argv scan found zero remaining processes naming this fixture root; this is not universal orphan detection. The harness log was empty.
+
+Before/after auth metadata SHA-256 was `1987ef4ee1e354dbac5566fde47c85a482d1a3530d3df6fbe93dc8d7fd57a909` in both observations. This fingerprints filesystem metadata without reading credential contents. The consumed task #751 fence remains intact; no additional native model review was launched.
+
+The required complete model-backed receipt was not obtained. The verified set remains 0.146.0, 0.163.0, 0.164.0 and 0.166.0. The person-controlled exact-version trust path and every runtime isolation proof remain unchanged. No production adapter, task behavior, test assertion, bundle, global install, account setting or documentation stamp is changed by this failed receipt. Final changed-source and exact-head hosted CI evidence are separate and recorded in the PR.
+
+## Private evidence fingerprints
+
+Private producers and safe metadata remain outside git under `scratchpad/temp/ahub-751`. The original account values, marker and model prose are not retained in the repository.
+
+| File | SHA-256 |
+| --- | --- |
+| `controller.ts` | `b278dc169bd85e73903158ba35a3a665c08c862d387581e90c8ecbaceecf069a` |
+| `run.ts` | `637d3eac56dd9a5e113e3996d8aabbf2c54b01777664d6e0c81d606e4a5af665` |
+| `setup-events.jsonl` | `e6489b086bea498e62073c98f5c6ff99b75defbef0ca5cc31d0e89bf34a8779a` |
+| `native-events.jsonl` | `89dbf07daff59346e0fa861de49244f62411fc660c532bd32565f4b5db87eea2` |
+| `post-cleanup.json` | `0470f71f36adcb57f1d323a77b798c9e0e0b25cf70e5b93ac0af52a170eaae2e` |
+
+The native event stream contains 10 safe metadata events (2703 bytes). This failed attempt does not qualify a version, establish a missing verdict, demonstrate model quality or authorize another run.

package/docs/verification/2026-11-06-kimi-251-reviewer-compat.md

@@ -0,0 +1,88 @@
+# Kimi 2.5.1 fresh-reviewer compatibility receipt
+
+Date: 2026-11-06. Scope: issue #888, task #748. This repeats the [2.4.1 model-free procedure](2026-10-31-kimi-241-reviewer-compat.md). Both isolated macOS native passes succeeded, including the proposed verified entry without machine trust. Only 2.5.1 qualifies; nearby versions remain unverified. No real account, inference or persisted Tasks verdict is part of the procedure.
+
+## Artifact and installation
+
+| Artifact | Binding |
+| --- | --- |
+| Upstream annotated tag | `@moonshot-ai/kimi-code@2.5.1`, tag object `232e42606210d4f1674f104abfa133043408b925` |
+| Peeled source commit | `1b02030d8c2c6b00131b23ebb67a231614877827` |
+| Official macOS arm64 archive | `kimi-code-darwin-arm64.tar.gz`, 54,789,239 bytes |
+| Archive SHA-256 | `fb0dc25033f2545c5cf820d01898fdc6e2a13a5d83529091fedee1dfef078632` |
+| Standalone executable SHA-256 | `d71bd6fed919cdcb12623fa1a096b9adc4f51ac26f55b5801bbe1aee5809e714` |
+| Standalone executable size | 182,590,912 bytes |
+| Source hub checkpoint | `f7cbefdaa924ee506117a994e2d14f1f92aeae55`, exact `@staix/agent-mem@0.21.0` |
+
+The archive came from the [official tagged release](https://github.com/MoonshotAI/kimi-code/releases/tag/%40moonshot-ai/kimi-code%402.5.1). Its SHA-256 matched both the GitHub asset digest and sibling checksum before bounded extraction in a dgx02 container. Extraction refused absolute paths, parent traversal, links, nonregular files and oversized expanded contents. Only the verified official standalone artifact was transferred to the isolated Mac prefix; no upstream source or node_modules tree is copied to the Mac. No global installer is used.
+
+## Isolated production and native controls
+
+The retained 2.4.1 producer is adapted only for the private executable/source paths, exact 2.5.1 version, source commit and evidence destination. It requires the current exact memory-core dependency, creates its own HOME, KIMI_CODE_HOME, temporary cwd, empty skills and synthetic managed-provider OAuth slot, and drives the production reviewer preparation and task-bound two-tool MCP broker.
+
+The source worktree used its own frozen install under a fake installation HOME,
+with pinned Bun 1.4.2 and exact memory core 0.21.0. No node_modules tree was copied.
+Before the isolated native work, the Mac showed 82.8% CPU idle, normal memory
+pressure (1), 0.56 MB swap used, and no local agent-hub heavy job; candidate gate
+processes were confirmed as SSH clients for remote jobs. The host has 18 logical
+CPUs. No thermal/performance warning was recorded, which is not a positive
+thermal measurement. No local check.sh, build or full test gate was run.
+
+| Leg | Fixture-trust run | Verified run, no trust |
+| --- | --- | --- |
+| Production preparation, exact version/current/config, replace environment | pass | pass, `fixtureTrustOnly: false` |
+| Exactly two MCP tools, empty subagents and skills, config mode 0600 | pass | pass |
+| Wrong task, third tool, missing authorization and revoked broker refusals | pass | pass |
+| Actual native two-tool loop, fixed loopback responses | pass, four requests | pass, four requests |
+| Injected Write absent from inventory and native tool-not-found result | pass, marker unchanged | pass, marker unchanged |
+| Explicit Write positive control | pass, two requests, marker written | pass, two requests, marker written |
+| Trust-workspace environment decoy removed from launch environment | pass | pass |
+| Original synthetic config/credential bytes, owned-group and temporary cleanup | pass | pass |
+
+Every restricted native request advertised exactly
+`mcp__agent-hub__hub_review` and `mcp__agent-hub__hub_task_show`. Both calls reached
+the production task-bound broker's synthetic callback; no real task board or
+persisted verdict was invoked. The positive control explicitly added Write to
+the private agent, establishing that its absence in the restricted run was an
+execution-time allowlist result. A separate preload positive control blocked a
+non-loopback HTTPS attempt before connection. The native fixture redirected
+only its copied provider/OAuth endpoint and synthetic credential slot to the
+owned loopback server. These application-level guards do not establish kernel
+network isolation.
+
+The initial run used an invented trust record only in its temporary hub home
+while 2.5.1 was absent from COMPAT. The second asserted a verified assessment for
+the proposed exact entry with an empty trust list and no trust record. Both
+prepared launches remained current after the native controls. Real account,
+login/provider readiness, real OAuth refresh, attached-TUI coexistence, model
+behavior/quality and quota remain unverified.
+
+## Source review
+
+A scoped review compared 2.4.1 source `2c73f3f50af4fa7f2540ca0d2e33b07a1408e3a7` with 2.5.1 source `1b02030d8c2c6b00131b23ebb67a231614877827`. The complete diff has 1,471 changed files; this receipt does not claim to review the full release.
+
+- `workspaceTrust/trustEnv.ts`, agent-file parsing, builtin tool assembly, tool registry and registry service, and `packages/oauth/src/oauth-manager.ts` are byte-identical at the two source commits.
+- [Workspace MCP configuration](https://github.com/MoonshotAI/kimi-code/blob/1b02030d8c2c6b00131b23ebb67a231614877827/packages/agent-core-v2/src/workspace/workspaceMcpConfig/workspaceMcpConfigService.ts) adds configuration-bound MCP OAuth cancellation/invalidation and retains credentials during trust changes. These paths concern the fixture's loopback task-bound HTTP MCP identity; no real OAuth exchange is in scope.
+- [Workspace trust service](https://github.com/MoonshotAI/kimi-code/blob/1b02030d8c2c6b00131b23ebb67a231614877827/packages/agent-core-v2/src/workspace/workspaceTrust/workspaceTrustService.ts) now waits for config and recognizes the explicit `workspace.require_trust` option. The new option defaults to requiring trust. The producer never supplies that opt-out and keeps its trust-environment decoy assertion.
+- `toolContribution.ts` renames the environment-capability type/property, and the managed Kimi credential adapter changes an import path. The agent-file tool allowlist and native registry assembly inspected above are unchanged.
+- The 2.5.0 and 2.5.1 changelog entries were read for isolation impact: remote execution environments, dynamic tool refresh after MCP changes, MCP OAuth cleanup and the workspace-trust opt-out are in the relevant scope. Model-free native exact-two-tool inventories across all fixed-response requests are still required; source inspection alone does not qualify the version.
+
+## Evidence and decision
+
+Evidence producers and raw result files are outside git under `scratchpad/temp/agent-hub-748`. The real Kimi install, account state and native home are not inputs to the isolated controls. No machine trust is changed. All required model-free legs passed, so exactly 2.5.1 is added to `COMPAT["kimi-review"].verified`; the receipt pointer and Kimi-only operations list advance to this procedure. No reviewer is enabled or launched on the real hub.
+
+| Evidence file | SHA-256 |
+| --- | --- |
+| `kimi-probe.ts` | `2ff8e2841f2cbd58d07add57e5deb9041ee33a692489083a176e6b5d5f406edf` |
+| `kimi-native-result.json` | `082720d3c4d47409a122b3ce8031d0c7b520ab04e07011cb541ef7b855faa188` |
+| `kimi-verified-result.json` | `fb1631f4ef47b565bf97bec267aa31ddbea25cfe2a6492eacdd7b144a545e6c0` |
+| `run-kimi.py` | `1822f6d597d4b4cd7128d451addf81cb7bcd67492f339ea363ba99b288f80f5e` |
+| `loopback-only.cjs` | `f4e4714ac846c9e1861306f19c1c656350d1d4180818bd834aa34d1ae0ced8df` |
+| `source-review.log` | `671748eaa956f97351763e70ae2e0d5b3873d2ad6349b352cc676f43e15eb56d` |
+| `source-trust-assembly.log` | `66346c8f19ad72b86bf44026d46bd2373af805136af434e5a9ec8faffd9f7282` |
+
+The source comparison and native controls qualify the observed standalone
+macOS arm64 artifact only. Other platforms, future versions and model-backed
+behavior are not inferred. Committed-head dgx02 `scripts/check.sh --changed`,
+bundle freshness and hosted exact-head CI are separate evidence; their final
+states are recorded in the PR.

package/docs/verification/2026-11-06-orca-1.4.250-cli-contract.md

@@ -0,0 +1,50 @@
+# Orca CLI contract recheck on 1.4.250
+
+- Issue: #1233; hub task #746.
+- Date: 2026-11-06, Asia/Seoul.
+- Orca: `orca --version` printed `1.4.250`. The previous receipt is [1.4.245](2026-11-02-orca-1.4.245-cli-contract.md).
+- Result: the commands agent-hub reads behave as on 1.4.245, with two additions the code did not handle. A `terminal wait` on a pane whose process ended fails with `terminal_exited`, and a wait held by a prompt answers `satisfied: false` with a `blockedReason`. Both are handled by #1233. Commands that create, close or switch a pane stay **unverified**, as before.
+
+## Why this recheck
+
+The 0.30.0 to 0.32.0 upgrade of this project (operation `3e1bea10`, 2026-11-06 07:16Z) stopped while restoring the codex terminal with `Orca terminal wait failed: exit status 1`. `run()` mapped only `terminal_handle_stale`; any other Orca error became a command error showing only the exit status, and the restoration loop stopped before its launcher check. Orca prints the error code on stdout with an empty stderr, so the code was lost.
+
+## How this was checked
+
+Read-only commands against the person's running Orca, from a script that printed field names, types, counts and error codes, never a value: `orca --version`, `terminal list --json`, `terminal show --terminal <handle> --json`, `terminal wait --terminal <handle> --for tui-idle --timeout-ms 1 --json` on every listed terminal, the same wait and `show` with a made-up handle, and `worktree current --json` in a temporary directory Orca does not manage. A 1 ms wait changes no pane. No handle, tab id, worktree id, host name or path is recorded here.
+
+For the codes a wait can raise, the bundled main process (`Orca.app/Contents/Resources/app.asar`) was read for the throw sites, without running or modifying it.
+
+## Observed on 1.4.250
+
+| Command | Observed | Code impact |
+| --- | --- | --- |
+| `terminal list --json` | exit 0, `ok: true`; `result` keys `hostScope`, `terminals`, `topologyRevisions`, `totalCount`, `truncated`. 31 rows, `truncated: false`, `totalCount` equal to the row count, handles and incarnations unique. 16 rows carried `agentIdentity` as a string; on the other 15 the key is absent (1.4.245 printed `null`). 8 rows read `orphaned: true, connected: true`. | None. `identityFrom` reads a missing key and `null` alike; the orphaned-and-connected pair is the existing `terminal-orphaned` blocker. |
+| `terminal show --terminal <handle> --json` | exit 0, `ok: true`; `result.terminal` holds the list fields plus `agentWait`, `paneRuntimeId` and `rendererGraphEpoch`. | None. |
+| `terminal wait ... --for tui-idle --timeout-ms 1 --json` | Of 31 terminals: 14 answered `satisfied: true`; 16 exit 1 with code `timeout`; 1 answered exit 0, `ok: true`, `satisfied: false` with `blockedReason: "agent-update-prompt"`. | New: the blocked answer was reported only as "did not become idle". The `terminal-unready` blocker now names Orca's reason. |
+| wait or `show` with a made-up handle | exit 1, `ok: false`, `error` keys `code`, `data`, `message`, code `terminal_handle_stale`, on stdout with nothing on stderr. | Unchanged. |
+| `worktree current --json` outside Orca | exit 1, `ok: false`, code `selector_not_found`. | Unchanged. |
+
+## Codes a wait can raise (source read)
+
+| Code | When the main process raises it | Before #1233 | After #1233 |
+| --- | --- | --- | --- |
+| `timeout` | the condition was not met within `--timeout-ms` | not satisfied | not satisfied |
+| `terminal_handle_stale` | the handle names no live pane | `terminal-gone` | `terminal-gone` |
+| `terminal_exited` | a `tui-idle` wait on a pane whose process ended | command error, "exit status 1" | `terminal-gone`, "exited (terminal_exited)" |
+| `terminal_gone` | the pane has no connected PTY | command error | `terminal-gone`, naming the code |
+| `no_connected_pty` | same family as `terminal_gone` | command error | `terminal-gone`, naming the code |
+| `request_aborted` | the wait was aborted | command error | command error, naming the code |
+
+Orca's own CLI groups `terminal_handle_stale`, `terminal_exited`, `terminal_gone` and `no_connected_pty` as one "terminal is gone" condition, which #1233 follows. During a restoration, a `terminal-gone` answer sends the loop to the launcher check: a launcher that recorded itself and is gone is `launcher-exited`; with no record, the terminal's listing decides, as for a stale handle. Any other Orca failure now shows `code: message` before falling back to the exit status.
+
+`terminal_exited` was not produced live: it needs a pane whose process ended. It is covered by the source read and by fixture tests in `test/terminal-recovery.test.ts`. Whether the upgrade's codex wait raised exactly this code cannot be shown after the fact, because the code was not recorded; the next failure will name it.
+
+## Unverified, with the reason
+
+| Command or behaviour | Why |
+| --- | --- |
+| `terminal create`, `terminal close`, `terminal switch` | They create, close or switch a live pane. |
+| `terminal_exited`, `terminal_gone`, `no_connected_pty` and `request_aborted` produced live | They need a pane whose process ended, a lost PTY or an aborted request. |
+| Other `blockedReason` values | Only `agent-update-prompt` was seen. |
+| A `truncated: true` inventory, remote servers, the Linux binary | As in the 1.4.245 receipt. |