@staix/agent-hub 0.32.0 → 0.34.0

package/docs/verification/2026-11-06-codex-0167-reviewer-tool-call.md

@@ -0,0 +1,66 @@
+# Codex 0.167.0 single reviewer tool-call attempt, not qualified
+
+Date: 2026-11-06. Scope: issue #888, task #751. This records exactly one newly authorized native reviewer attempt after the [0.167.0 model-free receipt](2026-11-06-codex-0167-reviewer-isolation.md), following the corrected [0.166.0 procedure](2026-11-02-codex-0166-reviewer-tool-call.md).
+
+**Result: qualification failed at the harness readiness/readback leg.** Native startup isolation and the accepted-plan marker precondition passed. The one-attempt fence was consumed once. The harness then reported `fixture readiness deadline` before it emitted `verdict-readback`. No complete persisted verdict/head/marker result was recorded, so the model/tool outcome remains unknown. This is not proof that the model failed to call a tool or that no verdict existed. No retry was made, and 0.167.0 stays outside `COMPAT["codex-review"].verified`.
+
+## Bound procedure and model-free preflight
+
+The source worktree branched from merged PR #1234 at `25878b3e66c80718f8512e0cfe5c05e4772853ec`. The retained task #625 controller and driver were copied only into a new private task directory. Adaptations changed the source path, task labels/environment prefix and exact native version from 0.166.0 to 0.167.0; the original consumed fence was not touched. The new task used its own persistent exclusive `wx` fence.
+
+The worktree had its own frozen dependency installation, exact `@staix/agent-mem@0.21.0`, and pinned Bun 1.4.2. The Mac native exception was admitted through `dot admit`, with normal memory, thermal state 0, about 87% CPU idle and no competing local admission owner. The global Bun executable was not changed.
+
+`--prepare` bound the installed exact 0.167.0 package and parsed the private driver without reading credential values. The setup-only rehearsal passed with zero native preparations and zero model requests, no auth symlink and no consumed fence. It created production daemon state only in fresh temporary homes, confirmed source/auth metadata stability and removed its temporary state. The current-source dgx02 model-free regression run passed 91 tests, 0 failed, 617 assertions across `review-scope`, `codex-review-isolation` and `compat` at that source head. This includes accepted-plan envelope coverage; it is not a native model result.
+
+The controller held the repository lock before creating fresh HOME, CODEX_HOME and TMPDIR. Actual mode created one auth symlink to the configured account, used eighteen bounded original credential roots in private paths and granted version admission only in the temporary hub home. It did not change machine trust or the real configuration. No account path, credential value, private marker value or model prose is included here.
+
+## One attempt and observed boundaries
+
+The native fixture uses production `startDaemon`, `ReviewerPrintPeer`, `codexReviewerBackend`, the stdio plugin and `Tasks`. A synthetic builder proposed and accepted an arithmetic task with the marker in one accepted `plan.risks` item. The wrapper verified the actual rendered review envelope contained that marker before opening the one-attempt fence and before calling the original `ReviewerPrintPeer.review`. It neither called `hub_review` on the model's behalf nor substituted a verdict.
+
+| Evidence | Observed |
+| --- | --- |
+| Source head | `25878b3e66c80718f8512e0cfe5c05e4772853ec` |
+| Platform / Bun / memory core | macOS arm64 / 1.4.2 / 0.21.0 |
+| Native startup reviewer | actual `ReviewerPrintPeer`, Codex 0.167.0 |
+| Startup binary identity | `sha256:213f7a2c8109c5f5158151b829bfc561bc76bbcdcce0b641c1e9a01b8b541e37` |
+| Startup isolation profile | `sha256:b0a4c1f0de7363e689a41056ec2ce21e5f0cead04399e1f8590c4cc1bc635af1` |
+| Backend source SHA-256 | `8e6ce4e64c6787a81e48a97172d25bbf1876ae5bc24a54934e7a107075a72214` |
+| Stdio plugin SHA-256 | `4c2b052a198b78a2162d410e8908e6501769632fcaa522ed88ee15a3a967dc88` |
+| Startup `readOnly`, `strictMcp`, `ephemeral` | all true |
+| Startup model-free evidence markers | all 14 present |
+| Actual envelope marker / summary withholding | present / review-only summary withheld |
+| Original review entries / fence consumptions | 1 / 1 |
+| Fixture start, UTC | `2026-11-06T09:05:41.828Z` |
+| Original review entered, UTC | `2026-11-06T09:05:42.679Z` |
+| Failed readiness check, UTC | `2026-11-06T09:06:10.455Z` |
+| Recorded cause | harness `fixture readiness deadline` |
+| Persisted state, reviewer and verdict count readback | unknown, no `verdict-readback` event |
+| Verdict head binding and marker match | unknown, not recorded |
+| Actual model tool-call result / turn isolation readback | unknown, not recorded |
+
+The failure event retained a stale phase label `reviewer-start`; that label is not used to attribute a native startup failure, because startup had already succeeded and `model-review-requested` was recorded. The private harness has bounded task/delivery readiness and reviewer-idle waits after that request. The preserved generic deadline does not identify a model/tool failure. Its fixed 110-second fixture and 120-second controller limits were not increased.
+
+The startup receipt retained the exact two-tool MCP allowlist, Apps/plugins/hooks disablement, legacy notify disablement, public/private/glob/symlink/credential and write-denial canaries, binary/config fences and ephemeral-session evidence. These are startup model-free observations. No post-turn isolation receipt was emitted, and effective model-turn network or web-search behavior is not inferred.
+
+## Cleanup and decision
+
+Production daemon stop and owned-group teardown were awaited; the controller confirmed its driver group was gone and released only its inode/owner-bound repository lock. Before cleanup, the synthetic source was unchanged and the original account auth metadata matched. The auth symlink, fake homes, source project, task state and temporary directory were removed. A later bounded argv scan found zero remaining processes naming this fixture root; this is not universal orphan detection. The harness log was empty.
+
+Before/after auth metadata SHA-256 was `1987ef4ee1e354dbac5566fde47c85a482d1a3530d3df6fbe93dc8d7fd57a909` in both observations. This fingerprints filesystem metadata without reading credential contents. The consumed task #751 fence remains intact; no additional native model review was launched.
+
+The required complete model-backed receipt was not obtained. The verified set remains 0.146.0, 0.163.0, 0.164.0 and 0.166.0. The person-controlled exact-version trust path and every runtime isolation proof remain unchanged. No production adapter, task behavior, test assertion, bundle, global install, account setting or documentation stamp is changed by this failed receipt. Final changed-source and exact-head hosted CI evidence are separate and recorded in the PR.
+
+## Private evidence fingerprints
+
+Private producers and safe metadata remain outside git under `scratchpad/temp/ahub-751`. The original account values, marker and model prose are not retained in the repository.
+
+| File | SHA-256 |
+| --- | --- |
+| `controller.ts` | `b278dc169bd85e73903158ba35a3a665c08c862d387581e90c8ecbaceecf069a` |
+| `run.ts` | `637d3eac56dd9a5e113e3996d8aabbf2c54b01777664d6e0c81d606e4a5af665` |
+| `setup-events.jsonl` | `e6489b086bea498e62073c98f5c6ff99b75defbef0ca5cc31d0e89bf34a8779a` |
+| `native-events.jsonl` | `89dbf07daff59346e0fa861de49244f62411fc660c532bd32565f4b5db87eea2` |
+| `post-cleanup.json` | `0470f71f36adcb57f1d323a77b798c9e0e0b25cf70e5b93ac0af52a170eaae2e` |
+
+The native event stream contains 10 safe metadata events (2703 bytes). This failed attempt does not qualify a version, establish a missing verdict, demonstrate model quality or authorize another run.

package/docs/verification/2026-11-06-kimi-251-reviewer-compat.md

@@ -0,0 +1,88 @@
+# Kimi 2.5.1 fresh-reviewer compatibility receipt
+
+Date: 2026-11-06. Scope: issue #888, task #748. This repeats the [2.4.1 model-free procedure](2026-10-31-kimi-241-reviewer-compat.md). Both isolated macOS native passes succeeded, including the proposed verified entry without machine trust. Only 2.5.1 qualifies; nearby versions remain unverified. No real account, inference or persisted Tasks verdict is part of the procedure.
+
+## Artifact and installation
+
+| Artifact | Binding |
+| --- | --- |
+| Upstream annotated tag | `@moonshot-ai/kimi-code@2.5.1`, tag object `232e42606210d4f1674f104abfa133043408b925` |
+| Peeled source commit | `1b02030d8c2c6b00131b23ebb67a231614877827` |
+| Official macOS arm64 archive | `kimi-code-darwin-arm64.tar.gz`, 54,789,239 bytes |
+| Archive SHA-256 | `fb0dc25033f2545c5cf820d01898fdc6e2a13a5d83529091fedee1dfef078632` |
+| Standalone executable SHA-256 | `d71bd6fed919cdcb12623fa1a096b9adc4f51ac26f55b5801bbe1aee5809e714` |
+| Standalone executable size | 182,590,912 bytes |
+| Source hub checkpoint | `f7cbefdaa924ee506117a994e2d14f1f92aeae55`, exact `@staix/agent-mem@0.21.0` |
+
+The archive came from the [official tagged release](https://github.com/MoonshotAI/kimi-code/releases/tag/%40moonshot-ai/kimi-code%402.5.1). Its SHA-256 matched both the GitHub asset digest and sibling checksum before bounded extraction in a dgx02 container. Extraction refused absolute paths, parent traversal, links, nonregular files and oversized expanded contents. Only the verified official standalone artifact was transferred to the isolated Mac prefix; no upstream source or node_modules tree is copied to the Mac. No global installer is used.
+
+## Isolated production and native controls
+
+The retained 2.4.1 producer is adapted only for the private executable/source paths, exact 2.5.1 version, source commit and evidence destination. It requires the current exact memory-core dependency, creates its own HOME, KIMI_CODE_HOME, temporary cwd, empty skills and synthetic managed-provider OAuth slot, and drives the production reviewer preparation and task-bound two-tool MCP broker.
+
+The source worktree used its own frozen install under a fake installation HOME,
+with pinned Bun 1.4.2 and exact memory core 0.21.0. No node_modules tree was copied.
+Before the isolated native work, the Mac showed 82.8% CPU idle, normal memory
+pressure (1), 0.56 MB swap used, and no local agent-hub heavy job; candidate gate
+processes were confirmed as SSH clients for remote jobs. The host has 18 logical
+CPUs. No thermal/performance warning was recorded, which is not a positive
+thermal measurement. No local check.sh, build or full test gate was run.
+
+| Leg | Fixture-trust run | Verified run, no trust |
+| --- | --- | --- |
+| Production preparation, exact version/current/config, replace environment | pass | pass, `fixtureTrustOnly: false` |
+| Exactly two MCP tools, empty subagents and skills, config mode 0600 | pass | pass |
+| Wrong task, third tool, missing authorization and revoked broker refusals | pass | pass |
+| Actual native two-tool loop, fixed loopback responses | pass, four requests | pass, four requests |
+| Injected Write absent from inventory and native tool-not-found result | pass, marker unchanged | pass, marker unchanged |
+| Explicit Write positive control | pass, two requests, marker written | pass, two requests, marker written |
+| Trust-workspace environment decoy removed from launch environment | pass | pass |
+| Original synthetic config/credential bytes, owned-group and temporary cleanup | pass | pass |
+
+Every restricted native request advertised exactly
+`mcp__agent-hub__hub_review` and `mcp__agent-hub__hub_task_show`. Both calls reached
+the production task-bound broker's synthetic callback; no real task board or
+persisted verdict was invoked. The positive control explicitly added Write to
+the private agent, establishing that its absence in the restricted run was an
+execution-time allowlist result. A separate preload positive control blocked a
+non-loopback HTTPS attempt before connection. The native fixture redirected
+only its copied provider/OAuth endpoint and synthetic credential slot to the
+owned loopback server. These application-level guards do not establish kernel
+network isolation.
+
+The initial run used an invented trust record only in its temporary hub home
+while 2.5.1 was absent from COMPAT. The second asserted a verified assessment for
+the proposed exact entry with an empty trust list and no trust record. Both
+prepared launches remained current after the native controls. Real account,
+login/provider readiness, real OAuth refresh, attached-TUI coexistence, model
+behavior/quality and quota remain unverified.
+
+## Source review
+
+A scoped review compared 2.4.1 source `2c73f3f50af4fa7f2540ca0d2e33b07a1408e3a7` with 2.5.1 source `1b02030d8c2c6b00131b23ebb67a231614877827`. The complete diff has 1,471 changed files; this receipt does not claim to review the full release.
+
+- `workspaceTrust/trustEnv.ts`, agent-file parsing, builtin tool assembly, tool registry and registry service, and `packages/oauth/src/oauth-manager.ts` are byte-identical at the two source commits.
+- [Workspace MCP configuration](https://github.com/MoonshotAI/kimi-code/blob/1b02030d8c2c6b00131b23ebb67a231614877827/packages/agent-core-v2/src/workspace/workspaceMcpConfig/workspaceMcpConfigService.ts) adds configuration-bound MCP OAuth cancellation/invalidation and retains credentials during trust changes. These paths concern the fixture's loopback task-bound HTTP MCP identity; no real OAuth exchange is in scope.
+- [Workspace trust service](https://github.com/MoonshotAI/kimi-code/blob/1b02030d8c2c6b00131b23ebb67a231614877827/packages/agent-core-v2/src/workspace/workspaceTrust/workspaceTrustService.ts) now waits for config and recognizes the explicit `workspace.require_trust` option. The new option defaults to requiring trust. The producer never supplies that opt-out and keeps its trust-environment decoy assertion.
+- `toolContribution.ts` renames the environment-capability type/property, and the managed Kimi credential adapter changes an import path. The agent-file tool allowlist and native registry assembly inspected above are unchanged.
+- The 2.5.0 and 2.5.1 changelog entries were read for isolation impact: remote execution environments, dynamic tool refresh after MCP changes, MCP OAuth cleanup and the workspace-trust opt-out are in the relevant scope. Model-free native exact-two-tool inventories across all fixed-response requests are still required; source inspection alone does not qualify the version.
+
+## Evidence and decision
+
+Evidence producers and raw result files are outside git under `scratchpad/temp/agent-hub-748`. The real Kimi install, account state and native home are not inputs to the isolated controls. No machine trust is changed. All required model-free legs passed, so exactly 2.5.1 is added to `COMPAT["kimi-review"].verified`; the receipt pointer and Kimi-only operations list advance to this procedure. No reviewer is enabled or launched on the real hub.
+
+| Evidence file | SHA-256 |
+| --- | --- |
+| `kimi-probe.ts` | `2ff8e2841f2cbd58d07add57e5deb9041ee33a692489083a176e6b5d5f406edf` |
+| `kimi-native-result.json` | `082720d3c4d47409a122b3ce8031d0c7b520ab04e07011cb541ef7b855faa188` |
+| `kimi-verified-result.json` | `fb1631f4ef47b565bf97bec267aa31ddbea25cfe2a6492eacdd7b144a545e6c0` |
+| `run-kimi.py` | `1822f6d597d4b4cd7128d451addf81cb7bcd67492f339ea363ba99b288f80f5e` |
+| `loopback-only.cjs` | `f4e4714ac846c9e1861306f19c1c656350d1d4180818bd834aa34d1ae0ced8df` |
+| `source-review.log` | `671748eaa956f97351763e70ae2e0d5b3873d2ad6349b352cc676f43e15eb56d` |
+| `source-trust-assembly.log` | `66346c8f19ad72b86bf44026d46bd2373af805136af434e5a9ec8faffd9f7282` |
+
+The source comparison and native controls qualify the observed standalone
+macOS arm64 artifact only. Other platforms, future versions and model-backed
+behavior are not inferred. Committed-head dgx02 `scripts/check.sh --changed`,
+bundle freshness and hosted exact-head CI are separate evidence; their final
+states are recorded in the PR.

package/docs/verification/2026-11-06-orca-1.4.250-cli-contract.md

@@ -0,0 +1,50 @@
+# Orca CLI contract recheck on 1.4.250
+
+- Issue: #1233; hub task #746.
+- Date: 2026-11-06, Asia/Seoul.
+- Orca: `orca --version` printed `1.4.250`. The previous receipt is [1.4.245](2026-11-02-orca-1.4.245-cli-contract.md).
+- Result: the commands agent-hub reads behave as on 1.4.245, with two additions the code did not handle. A `terminal wait` on a pane whose process ended fails with `terminal_exited`, and a wait held by a prompt answers `satisfied: false` with a `blockedReason`. Both are handled by #1233. Commands that create, close or switch a pane stay **unverified**, as before.
+
+## Why this recheck
+
+The 0.30.0 to 0.32.0 upgrade of this project (operation `3e1bea10`, 2026-11-06 07:16Z) stopped while restoring the codex terminal with `Orca terminal wait failed: exit status 1`. `run()` mapped only `terminal_handle_stale`; any other Orca error became a command error showing only the exit status, and the restoration loop stopped before its launcher check. Orca prints the error code on stdout with an empty stderr, so the code was lost.
+
+## How this was checked
+
+Read-only commands against the person's running Orca, from a script that printed field names, types, counts and error codes, never a value: `orca --version`, `terminal list --json`, `terminal show --terminal <handle> --json`, `terminal wait --terminal <handle> --for tui-idle --timeout-ms 1 --json` on every listed terminal, the same wait and `show` with a made-up handle, and `worktree current --json` in a temporary directory Orca does not manage. A 1 ms wait changes no pane. No handle, tab id, worktree id, host name or path is recorded here.
+
+For the codes a wait can raise, the bundled main process (`Orca.app/Contents/Resources/app.asar`) was read for the throw sites, without running or modifying it.
+
+## Observed on 1.4.250
+
+| Command | Observed | Code impact |
+| --- | --- | --- |
+| `terminal list --json` | exit 0, `ok: true`; `result` keys `hostScope`, `terminals`, `topologyRevisions`, `totalCount`, `truncated`. 31 rows, `truncated: false`, `totalCount` equal to the row count, handles and incarnations unique. 16 rows carried `agentIdentity` as a string; on the other 15 the key is absent (1.4.245 printed `null`). 8 rows read `orphaned: true, connected: true`. | None. `identityFrom` reads a missing key and `null` alike; the orphaned-and-connected pair is the existing `terminal-orphaned` blocker. |
+| `terminal show --terminal <handle> --json` | exit 0, `ok: true`; `result.terminal` holds the list fields plus `agentWait`, `paneRuntimeId` and `rendererGraphEpoch`. | None. |
+| `terminal wait ... --for tui-idle --timeout-ms 1 --json` | Of 31 terminals: 14 answered `satisfied: true`; 16 exit 1 with code `timeout`; 1 answered exit 0, `ok: true`, `satisfied: false` with `blockedReason: "agent-update-prompt"`. | New: the blocked answer was reported only as "did not become idle". The `terminal-unready` blocker now names Orca's reason. |
+| wait or `show` with a made-up handle | exit 1, `ok: false`, `error` keys `code`, `data`, `message`, code `terminal_handle_stale`, on stdout with nothing on stderr. | Unchanged. |
+| `worktree current --json` outside Orca | exit 1, `ok: false`, code `selector_not_found`. | Unchanged. |
+
+## Codes a wait can raise (source read)
+
+| Code | When the main process raises it | Before #1233 | After #1233 |
+| --- | --- | --- | --- |
+| `timeout` | the condition was not met within `--timeout-ms` | not satisfied | not satisfied |
+| `terminal_handle_stale` | the handle names no live pane | `terminal-gone` | `terminal-gone` |
+| `terminal_exited` | a `tui-idle` wait on a pane whose process ended | command error, "exit status 1" | `terminal-gone`, "exited (terminal_exited)" |
+| `terminal_gone` | the pane has no connected PTY | command error | `terminal-gone`, naming the code |
+| `no_connected_pty` | same family as `terminal_gone` | command error | `terminal-gone`, naming the code |
+| `request_aborted` | the wait was aborted | command error | command error, naming the code |
+
+Orca's own CLI groups `terminal_handle_stale`, `terminal_exited`, `terminal_gone` and `no_connected_pty` as one "terminal is gone" condition, which #1233 follows. During a restoration, a `terminal-gone` answer sends the loop to the launcher check: a launcher that recorded itself and is gone is `launcher-exited`; with no record, the terminal's listing decides, as for a stale handle. Any other Orca failure now shows `code: message` before falling back to the exit status.
+
+`terminal_exited` was not produced live: it needs a pane whose process ended. It is covered by the source read and by fixture tests in `test/terminal-recovery.test.ts`. Whether the upgrade's codex wait raised exactly this code cannot be shown after the fact, because the code was not recorded; the next failure will name it.
+
+## Unverified, with the reason
+
+| Command or behaviour | Why |
+| --- | --- |
+| `terminal create`, `terminal close`, `terminal switch` | They create, close or switch a live pane. |
+| `terminal_exited`, `terminal_gone`, `no_connected_pty` and `request_aborted` produced live | They need a pane whose process ended, a lost PTY or an aborted request. |
+| Other `blockedReason` values | Only `agent-update-prompt` was seen. |
+| A `truncated: true` inventory, remote servers, the Linux binary | As in the 1.4.245 receipt. |

package/docs/verification/2026-11-06-qwen-0268-acp.md

@@ -0,0 +1,75 @@
+# Qwen Code 0.26.8 ACP receipt
+
+Date: 2026-11-06. Task #749, Refs #888, `qwen` row only. This repeats the [0.26.5 ACP receipt](2026-11-03-qwen-0265-acp.md) with the exact published `@qwen-code/qwen-code@0.26.8`, isolated installation and native controls. The [dual-output receipt](2026-11-06-qwen-0268-dual-output.md) owns the separate TUI decision.
+
+**Decision: add exactly `0.26.8` to `COMPAT.qwen.verified`.** Every ACP leg and the reviewed optional install-lifecycle replay passed natively on macOS arm64, repeating the previous receipt's platform. The earlier Linux x86_64 run is additional evidence. No intermediate release, range or dual-output admission is inferred.
+
+## Artifact and isolation
+
+The [official release](https://github.com/QwenLM/qwen-code/releases/tag/v0.26.8) and [npm artifact](https://registry.npmjs.org/@qwen-code/qwen-code/0.26.8) identify the same commit. npm installed into a new private prefix with scratch HOME, cache and tmp, empty user/global npm configs and no global installer. The installed lock's integrity matches the registry SRI. A separate private 0.26.1 prefix supplies the dual-output control; the person's global 0.26.1 installation is read-only.
+
+| Artifact | Binding |
+| --- | --- |
+| npm release and upstream tag | `0.26.8`, `21ed8f1efbb351b973d96e2bc9efa78f278df99c` |
+| npm integrity | `sha512-/BD+zs+VmOqInnYed3sxj7OKpBjAyZ7qoMw7Y9vLAur7QS66hsoiNAjUaON0yw6fS7WPTzN8mFZYvn3jdA3c/Q==` |
+| `cli-entry.js` SHA-256 | `113efe4104a9fc66f507d34bfd6abbd896ceb77de47f4b468a0825a327fdc6a5` |
+| `chunks/acpAgent-WH2KFCHG.js` SHA-256 | `bf55d693c0c9a1e682c4be2f65b74d1c7642923541cd95acdab1f7b764f60c47` |
+| Primary native host | macOS arm64, Node 24.18.1, npm 11.16.0 |
+| Additional host | dgx02 isolated Linux x86_64 container, Node 24.22.0, npm 11.19.1 |
+
+npm held one lifecycle script in each Linux prefix and the fresh Mac candidate prefix, `@qwen-code/audio-capture` `install` (`node install.js`). The exact script is identical in candidate and control, SHA-256 `bf91a3db08fdaf1622a0fa938f1f0e29cef712586ca13c2b0ac2422dd3f916fd`. It invokes `node-gyp-build` for the optional microphone addon, reports a non-fatal fallback and exits 0 if no addon can be built. No script was disabled to make a probe pass. The exact scripts were replayed in both Linux prefixes and the Mac candidate prefix under their private HOME/tmp and private executable PATH, with build concurrency at two, and exited 0. Fresh ACP and permission probes after the replay passed again. A prior exit 75 deferred this leg; only the subsequent completed replay is install proof. This does not qualify microphone functionality.
+
+Both platform runs used the same producers and a fresh temporary HOME/cwd, private `QWEN_HOME`, `QWEN_RUNTIME_DIR` and `XDG_CONFIG_HOME`, a synthetic key and fixed model with `--auth-type openai --model fixture-model --openai-base-url http://127.0.0.1:9/v1 --telemetry=false`. The ACP Node preload denied network APIs and recorded six blocked startup attempts. This is preload evidence, not kernel network isolation.
+
+The same read-only configuration snapshot as the previous receipt covered files under the person's `~/.qwen` and `~/.pi/agent` (excluding sessions, logs, cache, install and bin, and files at least 2 MiB), plus global qwen's `cli-entry.js` and `package.json`. All 9,576 entries matched before and after both the remote runs and the later actual Mac installation/probes; aggregate manifest SHA-256 `7c8dfc2ddfbaf1fdadfbcc78881918d225aeca1393a230fdfb5e0216fcfc97a3`. No real configuration or global binary was an installation target.
+
+## Native ACP, no prompts
+
+`qwen --acp --bare --advisor off` initialized protocol version 1 with `agentInfo` name `qwen-code`, title `Qwen Code` and version `0.26.8`. Only the synthetic OpenAI terminal auth method was offered. `session/new` succeeded and exposed only `fixture-model`.
+
+The available native mode ids were `plan`, `default`, `auto-edit`, `auto` and `yolo`, initially `default`. Every transition in `default -> auto-edit -> yolo -> default` returned an acknowledgement. This proves the hub's existing three mapped ids as a subset; it adds no mapping for `plan` or `auto`. ACP prompts sent: 0. The leader exited after its owned group received SIGTERM and the producer confirmed `groupGone: true`.
+
+## Actual published permission handler
+
+An exports-only scratch copy of the actual published ACP chunk appended `export{SubAgentTracker,toPermissionOptions,resolvePermissionOutcome}` beside the original, preserving relative imports. The original chunk was not edited. Synthetic client/tool/event ports invoked the native `SubAgentTracker.createApprovalHandler` directly, without a model-generated tool turn.
+
+- The request bound the fixture session, pending tool-call id, raw input, native MCP metadata and permission progress updates.
+- The exact options were `proceed_always_project` and `proceed_always_user` as `allow_always`, `proceed_once` as `allow_once`, and `cancel` as `reject_once`.
+- Allow-once reached `event.respond` as `proceed_once`; a second actual callback with a cancelled outcome reached it as `cancel`.
+- The real outcome helper rejected an unoffered option. No permission-fixture network attempt was recorded.
+
+## Actual macOS arm64 repetition
+
+Review finding `qwen-0268-macos-evidence-missing` identified that the verified set is not platform-scoped. The Linux-only receipt did not prove admission on this Mac. A fresh Mac private prefix therefore repeated the actual published artifact, using empty npm configs and private HOME/cache/tmp with Node 24.18.1. The original global Qwen 0.26.1 binary and real homes were not launch or install targets.
+
+Native resource admission was checked manually before this explicit native exception: 18 logical CPUs, load 4.31, CPU idle 85%, memory pressure normal (`1`), Foundation thermal state nominal (`0`), no active swap-in/out and no direct local repository build/test/install job. No source clone or local build/test gate ran. npm's held optional microphone lifecycle was reviewed and replayed in the private prefix before the ACP probes; it exited 0, without claiming microphone functionality.
+
+The native Mac returned `qwen-code` version 0.26.8 and protocol 1, created a session, advertised the same five mode ids and fixture model, and acknowledged `default -> auto-edit -> yolo -> default`. ACP prompts sent: 0. The actual published permission handler passed allow-once, cancellation and unoffered-option refusal with the same exact options. All owned processes were gone after SIGTERM (`groupGone: true`); six startup network API calls were blocked by the unchanged preload. The 9,576-entry real-home/global-entry snapshot matched byte for byte before and after this native run.
+
+## Not verified
+
+Microphone functionality, Intel macOS, a real login/provider, model-generated permission turns, model behavior, token/quota behavior and TUI qualification. The scoped claim is the native ACP/permission behavior on the exact artifact and the two explicitly named hosts above. This run does not review every upstream source change. Host changed-source checks and exact-head hosted CI are separate PR evidence. `docs/verified.json` is not restamped.
+
+## Evidence fingerprints
+
+Producers and native result JSONs remain outside git under `scratchpad/temp/agent-hub-749`. Linux private npm packages remain on dgx02; the independent Mac private prefix is under `mac/prefix`, outside the global installation. The ACP producer differs from the previous one only in paths, expected version and OS temp-root binding; the permission producer changes import/output bindings. The dual v2 producer changes only the platform annotation, preserving all workload assertions and timeouts.
+
+| File | SHA-256 |
+| --- | --- |
+| `qwen-acp-probe.py` | `897ff1b615f93da8cf5d0a93a5ce150eadfc55e87dce1d44625ad833c236691f` |
+| `qwen-acp-result.json` | `af079bbc67b7392716583b168ba7aaf662638df769b857bbf5097f88f11336fe` |
+| `qwen-permission.mjs` | `d777feb9070f254238f5ecf57f510e6af88e817b559919f65160bfd7db02a154` |
+| `qwen-permission-result.json` | `958a77ea7618e0efd04a78520aadf83654e5b74a0158a05061d0bed4406d7c31` |
+| `deny-network.cjs` | `361148af658dd4b65ed35308622ec99bb882ec5a25fab54581776546f139e892` |
+| `replay-audio.sh` | `b4bfb8bb3206a4fc658c8b62cb55150a9d949cddea9d265dbc9732ef4cba27cd` |
+
+Mac-specific evidence, in addition to the Linux fingerprints above:
+
+| File | SHA-256 |
+| --- | --- |
+| `mac/run-native.sh` | `d32db1e1cf23a4bd0e898b93fb1db4c0f217d730e1c8c8d4eef1613111b40c75` |
+| `mac/results/artifact.json` | `2c9d34a97b206a6463ebe2ee4aa1de8c73c945bf1e0de189e8bc8474deccc92d` |
+| `mac/results/qwen-acp-result.json` | `fee582148aa37e826285f6d642dc4eb7cbc1469076ecd7548ecb381133b1e212` |
+| `mac/results/qwen-permission-result.json` | `958a77ea7618e0efd04a78520aadf83654e5b74a0158a05061d0bed4406d7c31` |
+| `mac/real-before.json` | `7c8dfc2ddfbaf1fdadfbcc78881918d225aeca1393a230fdfb5e0216fcfc97a3` |
+| `mac/real-after.json` | `7c8dfc2ddfbaf1fdadfbcc78881918d225aeca1393a230fdfb5e0216fcfc97a3` |

package/docs/verification/2026-11-06-qwen-0268-dual-output.md

@@ -0,0 +1,44 @@
+# Qwen 0.26.8 dual-output attempt, not qualified
+
+Date: 2026-11-06. Task #749, Refs #888, the separate `qwen-dual` row. The [ACP receipt](2026-11-06-qwen-0268-acp.md) does not qualify the TUI. This repeats the [0.26.5 attempt](2026-11-03-qwen-0265-dual-output.md) using the same corrected v2 producer, fixed OpenAI-compatible loopback responses and a private 0.26.1 matched control. No account, real credential or model inference was used.
+
+**Decision: do not add 0.26.8 to `COMPAT["qwen-dual"].verified`.** Required Q2 did not pass. Exactly 0.26.1 stays verified for this entry, and the qwen-dual row is unchanged. This is not qualified, even though the other selected legs passed.
+
+## Artifact and controls
+
+The exact candidate is the ACP receipt's private-prefix `@qwen-code/qwen-code@0.26.8`, npm/upstream commit `21ed8f1efbb351b973d96e2bc9efa78f278df99c`. The control is a separately installed private `@qwen-code/qwen-code@0.26.1`; neither control nor candidate uses the person's global prefix. Both entry files have SHA-256 `113efe4104a9fc66f507d34bfd6abbd896ceb77de47f4b468a0825a327fdc6a5`. Entry equality is not program equality; the runtime is in version-specific chunks.
+
+The runs used a dgx02 Linux x86_64 container and Node 24.22.0. Each case had a PTY, private HOME/cwd, input/event files, scratch git project, synthetic key and deterministic loopback server. The guard positive control passed, every observed Node process loaded the guard, every owned process group was confirmed gone and every fixture root was removed. Model inference calls: 0. Preload evidence is not a kernel network sandbox or an independent audit of arbitrary native subprocess sockets.
+
+The real macOS configuration/global-install snapshot was unchanged across these remote runs: 9,576 entries, same aggregate manifest SHA-256 `7c8dfc2ddfbaf1fdadfbcc78881918d225aeca1393a230fdfb5e0216fcfc97a3`, with the previous receipt's documented snapshot exclusions. No real HOME or global installation was targeted. The optional audio-capture install lifecycle was subsequently replayed in both private prefixes and exited 0, as tracked in the ACP receipt; it cannot make the failed Q2 a pass.
+
+## Observed outcomes
+
+| Check | 0.26.8 | Matched 0.26.1 control |
+| --- | --- | --- |
+| Q7 version and network-guard positive control | pass, 0.26.8 | pass, 0.26.1 |
+| Q2 second submit becomes a separate user turn after the first completes | **fail**: `Q2 fewer than two user events` | **fail**, same error and workload |
+| Q3 shell/native MCP `can_use_tool`, allow/deny, TUI Enter, duplicate refusal and read-only control | pass | not selected |
+| Q4 external cancel/SIGINT leaves the turn running; person Esc stops it and next turn works | pass, existing ceiling retained | not selected |
+| Q5 unread event FIFO does not block the TUI answer | pass | not selected |
+| Q6 resume id, no old-submit replay, prior context in resumed request | pass | not selected |
+
+Q2 recorded `prematureSecondUser: false` and `userCount: 1` in both versions. The final assistant contained both submitted markers, followed by one `message_stop`; the required second distinct user event was absent. The matched failure prevents attribution as a new 0.26.8 regression. It also prevents this workload from establishing the queued-submit observation in the [original 0.26.1 receipt](2026-10-25-qwen-dual-output-t0.md). No assertion, workload or timeout was weakened to make Q2 pass.
+
+Q3 observed actual shell and `mcp__t0__t0_echo` requests with exact input, tool-use id and permission suggestions. Allow and TUI Enter produced the one intended effect; duplicate responses were errors without a second effect. Deny left its marker absent and a later turn worked. Read-only commands ran without approval. The tiny native MCP fixture handler ran exactly once and only after allow.
+
+Q4 bound the native TUI PID and process identity before signalling it. It records the same report-only cancellation ceiling, not permission for the hub to signal a person's terminal. Q6 preserved the session id, rotated the event file like the host adapter, retained old input without replay and observed the prior context token in a resumed fixed provider request; model recall quality is unverified.
+
+## Not verified
+
+Q2 on any version with this producer, macOS and other platforms, real account/provider, model choices/quality, token/quota behavior, and a new qwen-dual admission. A scoped native result does not review every upstream source change. Explicit failed and unselected legs remain as recorded. Host tests and exact-head hosted CI are separate PR evidence. No TUI adapter, queue, cancellation policy, real install or existing 0.26.1 admission changed.
+
+## Evidence fingerprints
+
+The corrected producer and JSON results remain outside git under `scratchpad/temp/agent-hub-749`.
+
+| File | SHA-256 |
+| --- | --- |
+| `qwen-dual-probe-v2.py` | `57714a102ce61083eda04dd092bc837704362428c133f34f6772744508965f93` |
+| `qwen-dual-0268-result.json` | `c52155b7338bce515c77aaad1582dc39aed71cca62aebc53eb851b226b073e0a` |
+| `qwen-dual-0261-control-result.json` | `867a223826a4e6e8fe31934269649bee90dce26478044a0ef5534202f190211e` |

package/docs/verification/2026-11-07-0.34.0.md

@@ -0,0 +1,71 @@
+# 0.34.0 release verification
+
+This record covers release preparation and source review. It claims no installation, no running-hub upgrade to 0.34.0 and no live TUI launch.
+
+## Candidate
+
+Version 0.34.0, prepared from main `0cb82278` plus the release branch's CHANGELOG commit `b21303e7` (5 commits since v0.33.0, 1 of them `feat`; bump rule: minor). The release commits carry the version, the CHANGELOG section, the bundle and the documentation stamps.
+
+## Reviews
+
+Pull requests named by the commits since v0.33.0: #1251, #1249, #1247, #1250.
+
+All four PRs merged at the head their review bound, after exact-head CI was green and with no unresolved review thread. Skipped ancillary jobs are not test proof.
+
+| PR / task | Review | Approved and final PR head | Merge commit | Hosted CI |
+| --- | --- | --- | --- | --- |
+| [#1250](https://github.com/STAIxBWLB/agent-hub/pull/1250), task 759 | claude (hub review) | `1493f2668a725ba198b445a1e65381546e0241b6` | `e5a2ead7051408669abdf29ba9b4becdcce1ba88` | [20 success, 2 skipped](https://github.com/STAIxBWLB/agent-hub/actions/runs/42316841052) |
+| [#1247](https://github.com/STAIxBWLB/agent-hub/pull/1247), no task | conductor OCR review only (docs, authored and merged in the conductor's session) | `ef268f8be415116da22735d5add21b52e7f5ed0f` | `3440e7b10dc6b4537d56541774436aa4f7d49a92` | [19 success, 2 skipped](https://github.com/STAIxBWLB/agent-hub/actions/runs/42319952686) |
+| [#1249](https://github.com/STAIxBWLB/agent-hub/pull/1249), task 760 | codex-review (code scope, #852), plus conductor OCR | `ca0934eaaf56dd4940b5a1626886093efdbb176f` | `41a44bb9fd1a8e8266d777244d51fe29ba0fcf66` | [19 success, 2 skipped](https://github.com/STAIxBWLB/agent-hub/actions/runs/42331647313) |
+| [#1251](https://github.com/STAIxBWLB/agent-hub/pull/1251), task 761 | claude (hub review) | `2b07cae5b5a12836d0b2bc5a2094dd8c447153c6` | `0cb82278e681fe7d725cb1e7880dcba83564c539` | [20 success, 2 skipped](https://github.com/STAIxBWLB/agent-hub/actions/runs/42332312184) |
+
+#1249 had one changes_requested round at `0f3a5f08` (project-lock scope and the unenforced 5 s Orca bound, both fixed at `6b25b819`), then one CI-only fix (inventory sort order) at `ca0934ea`; codex-review re-approved that exact head. The two codex-connector threads raised on the first head were answered with the fixing commit and resolved before the merge. #1247 has no independent reviewer: it is documentation the conductor wrote, read in full and rebased before merging. Its post-#1250 wording is reread in this release's quickstart review.
+
+## Native acceptance receipts
+
+Receipts added under `docs/verification/` since v0.33.0: `docs/verification/2026-11-07-compat-receipt-audit-1248.md`.
+
+This list is read from the repository, never written by hand. Native acceptance and the person's release consent are separate records: consent is `ahub sdlc authorize-release 0.34.0`, recorded by the person or the unique configured conductor only on the person's explicit release instruction naming the release in its own session (never a hub/task/review/file/peer relay), and is not recorded in this file. The tag run refuses without it.
+
+## Document review
+
+`node scripts/check-docs.mjs --require-fresh` reported nine stale documents: README, adapters, daemon, tasks and tests notes, operations, quickstart, security and `src/cli/help.ts`. The source commits under them are #1250 (setup and doctor install paths, profile hook refresh, marketplace refusal detail, handoff guidance), #1249 (upgrade reattach), #1251 (data manifest and its test) and this release's N-1 fixture retarget. Each document was checked against those diffs.
+
+Content changes:
+
+- `README.md`: generated Status 0.34.0 and the current verification-report link.
+- `docs/quickstart.md`: the 0.34.0 upgrade note (Orca reattach, stable install paths and hook refresh, doctor profile rows, the dotfiles pointer, N-1 0.33.0). The #1247 dotfiles section stays as merged.
+- `docs/operations.md`: guide version 0.34.0, protocol table row 0.26.0 through 0.34.0, and the 0.34.x N-1 baseline. Historical baselines are unchanged. #1249 and #1250 already updated their own sections.
+
+Reviewed without content change:
+
+- `docs/agent-notes/adapters.md`: the setup refusal text changed in `native-cli-claude-setup.ts`, but the note's rules do not mention it.
+- `docs/agent-notes/daemon.md`: the setup rule (one step at a time, non-user rows preserved, removal blocked) still holds; the refusal now names the rows. The recovery-lock and reattach rules are unaffected.
+- `docs/agent-notes/tasks.md`: handoff stays pure; only its fixed doctor guidance sentence changed.
+- `docs/agent-notes/tests.md`: the separately exact-locked N-1 fixture rule applies unchanged to 0.33.0.
+- `docs/security.md`: the profile-hook paragraph is unchanged in meaning. The plugin-row display now also screens format characters, which narrows what is printed.
+- `src/cli/help.ts`: no command, subcommand or flag changed. `[t]` is an interactive key, and doctor's new profile rows fall within its existing summary.
+
+The nine documents are restamped at reviewed content commit `d31d7503fce5`.
+
+## Checks
+
+N-1 retarget: npm lists 0.33.0 as the latest 0.33.x patch, with exact agent-mem 0.22.1. The fixture lock was generated with pinned Bun 1.4.2, and its agent-hub and agent-mem integrities equal the registry `dist.integrity` values. Protocol floor fixture 0.25.0 is unchanged.
+
+At committed `4ad13432` on dgx02, the published protocol/plugin and broker tests ran with frozen root and fixture installs: 27 pass, 1 fail. The failure was `an upgraded link keeps ephemeral liveness on the actual published N-1 broker`, which asserted that the codec-less 0.32.0 broker yields no codec support. The published 0.33.0 broker relays codec presence, so that expectation is now `true` (commit `d31d7503`, stated in the CHANGELOG N-1 entry). The rerun on the release head is recorded below.
+
+At committed `c49ae97482c7` on dgx02, with pinned Bun 1.4.2 and frozen root and fixture installs, the following passed:
+
+- `node scripts/check-docs.mjs --require-fresh --committed`: 0 stale documents.
+- `bun x tsc --noEmit`.
+- `bun scripts/build.mjs --check`.
+- `node scripts/check-package.mjs`: 807 files, `@staix/agent-hub@0.34.0`.
+- The published protocol/plugin and broker tests: 28 pass, 0 fail, 175 assertions.
+
+The full suite on both OSes is the release PR's exact-head hosted CI. The release PR is merged with a merge commit only when that CI is green.
+
+## Known gaps, not blocking
+
+- A live Orca restart with orphaned panes (#1249) was not reproduced; the reattach path is covered by fakes and a hung-runner test.
+- A real dotfiles-managed install running `ahub setup` (#1250) was exercised by the person's machine before the fix, not after; the fixed paths are covered by fixtures.
+- No installation, running-hub upgrade or real-account inference is claimed here.