@staix/agent-hub 0.34.0 → 0.35.0

package/docs/verification/2026-11-07-jcode-receipt-reconstruction-1248.md

@@ -0,0 +1,118 @@
+# Jcode receipt reconstruction: partial control, not qualified (#1248)
+
+Date: 2026-11-07. Task #767. This is new proof code, not promotion of the missing
+producer behind [the historical Mac receipt](2026-10-26-jcode-0.99.1.md).
+
+The isolated Linux x64 control executed the verified 0.99.1 release. Isolation,
+serve cleanup, ACP and MCP passed. Telemetry and the strict persisted-context
+binding failed. Source comparison remains not-run. These failures are retained;
+this report makes no COMPAT, trust or macOS qualification change.
+
+## Artifact and runner binding
+
+The public [v0.99.1 release](https://github.com/1jehuang/jcode/releases/tag/v0.99.1)
+provides `jcode-linux-x86_64.tar.gz`, 56203997 bytes, with SHA-256
+`0b2a612de97c6e01ae6de1c0cff555b3460cf8364d1a11d2f8649fc0c9d7a1e6`.
+The installer verified its tagged asset digest and `SHA256SUMS` before extraction.
+The archive has a 505-byte regular wrapper `jcode-linux-x86_64` and its regular
+adjacent `.bin`; their names and bytes are preserved.
+
+At `350a3d042fc9d9680fa84b90c82f5c77bd3941b7`, dgx02 ran Bun 1.4.2 in a
+disposable Linux x64 container. Typecheck and 79 fixture tests passed. The actual
+native control's installation passed with the digest above; its overall outcome
+was failure, with owned stop confirmed and lifetime process cleanup unproven.
+The container's lifetime supplies containment. The control sets `autoAdmit:false`
+in a temporary in-memory Linux projection and never spoofs its OS or architecture.
+The checked-in manifest still requires macOS arm64.
+
+The Mac archive's acquisition was checked separately on Linux without executing
+its binary: SHA-256
+`3623164d518b0c9d443ab07052084244b379e8a3377037db67d2382220f4ed14`,
+wrapper `jcode-macos-aarch64`. That is packaging evidence, not native Mac evidence.
+
+## Reconstructed procedure and observed legs
+
+The single imported module owns private HOME/JCODE_HOME, the loopback provider,
+serve/ACP children and their cleanup. Serve and ACP argv reuse production
+`jcodeCommand`; version and private-provider configuration use parameterized
+commands. The MCP entry carries no peer environment; the observer checks the
+two synthetic owned-launch markers inherited by its native child. No real native
+home, account, API key or model is supplied. The four real-home hashes from the
+historical receipt were not reproduced: only the private HOME decoys are fenced.
+
+| Leg | 0.99.1 Linux observation |
+| --- | --- |
+| isolation | pass: private environment and unchanged private decoy files |
+| serve-cleanup | pass: ready FD/socket/sidecar metadata and stopped owned groups |
+| acp-initialize-new-load-mode-ceilings | pass: protocol/identity/new/load and both unsupported-method checks |
+| mcp-owned-environment | pass: actual eager child inherits the two expected markers |
+| active-turn-soft-interrupt | fail: strict private persisted System-carrier binding was not established |
+| telemetry | fail: `telemetry_id` appeared in the private native home |
+| source-comparison | not-run: scoped source investigation is not the historical full compare review |
+
+`session/load` still omits `sessionId`. The existing withheld recovery guarantee
+and `requireLoadSessionEcho` policy are unchanged.
+
+The fixed-stream loopback turn reached ping capability, same-session subscribe,
+idle/active state, non-urgent interrupt acknowledgement, `end_turn` and two
+completion bodies. Closed observations classified the first request as native
+context plus original prompt, and the second as context, original, streamed head
+and steer. Those observations do not substitute for the failed persisted-role
+assertion. The final code also counts every completion POST attempt, rejecting a
+third attempt even when its body is refused by the two-body storage cap.
+
+## Narrow context and lock rules
+
+Pinned source
+[session.rs](https://github.com/1jehuang/jcode/blob/7206efd0c1dbf49ef38d06b63f3a96a3a7cee611/crates/jcode-base/src/session.rs#L989)
+and [prompt.rs](https://github.com/1jehuang/jcode/blob/7206efd0c1dbf49ef38d06b63f3a96a3a7cee611/crates/jcode-base/src/prompt.rs#L656)
+define the hidden user/System-display session-context carrier. The allowed
+exception requires the new private session's matching ID and working directory,
+a first stored `role:user`/`display_role:system` text carrier, the exact reminder
+frame and seven field names, and identical bytes once at the same position in
+both provider requests. Only that carrier may be excluded. Duplicate, forged,
+changed-field, extra-field, moved or app-sentinel carriers fail. Application
+original/head/steer bytes, order and all generic extra-user negatives remain
+strict.
+
+The Linux control failed that binding. The source also permits optional hardware
+and Git context, which the seven-field rule does not admit. That is a possible
+platform-dependent limitation, not a diagnosis proved by the closed failure
+checkpoint. Snapshot/journal coverage is not inferred when the role binding is
+unavailable.
+
+Today's 0.99.1 control creates an empty `telemetry_id.lock`. The proof treats only
+that exact zero-byte, regular, single-link, run-owned file in the private native
+home, with `JCODE_NO_TELEMETRY=1`, as coordination rather than telemetry data.
+Non-empty, symlink, hardlink and wrong-location locks fail; identity, event and
+milestone artifacts still fail. The same control subsequently detected
+`telemetry_id`, so the telemetry leg remains failed. File presence does not prove
+that telemetry was transmitted.
+
+We cannot tell whether the original 2026-10-26 producer saw the empty lock,
+ignored it, or whether it did not appear then. The historical receipt is unchanged
+and is not claimed to cover this allowance.
+
+## Acquisition and runner corrections
+
+The real control exposed three shared harness defects:
+
+- GitHub release metadata rejected `Accept:application/octet-stream` with HTTP
+  415. Metadata now requests JSON; archive/checksum requests retain binary content
+  negotiation and every redirect, checksum and pre-effect integrity check.
+- The archive wrapper is platform-qualified rather than named `jcode`. An
+  optional trusted recipe executable basename selects its unique existing file;
+  traversal, links and paths outside the verified prefix remain refused.
+- A nested command runner counted its own proof worker's private request path as
+  a survivor. Only that current PID is excluded from the path heuristic. Known
+  descendants and other private-root processes remain detected, and lifetime
+  cleanup remains unproven. A separately owned helper negative verifies that the
+  observation never grants authority to signal it.
+
+The metadata regression failed on dgx02 before its correction. Header-sensitive
+and executable-selector fixtures retain all archive, timeout and integrity
+negatives. Protocol fakes exercise the application/role/context/telemetry and
+third-request refusals; they are not native-version qualification evidence.
+Diagnostics contain bounded closed labels, booleans and counts only, and are
+never admission data or native content. Final committed-head gate and review
+evidence are recorded in the PR/task.

package/docs/verification/2026-11-07-kimi-delayed-usage.md

@@ -0,0 +1,34 @@
+# Kimi delayed usage and attribution receipt (#1281)
+
+## Scope and isolation
+
+Measured on 2026-11-07 with agent-hub source `a3de35e41ca26614108593b61de5674a960b2b95` plus the #1281 working change, and Kimi Code CLI 2.5.2. ACP initialization served protocol version 1 and agent version 2.5.2. The wire log declared protocol version 1.5.
+
+The measured process had a new disposable cwd, `HOME`, `KIMI_CODE_HOME`, `TMPDIR` and `XDG_CONFIG_HOME`. Its generated native config retained only the installed managed provider and model settings, with hooks and telemetry disabled. The installed account's credential/oauth directories and device identity were symlinked into the disposable native home without printing their contents. No personal project or prior session was read. No credential or plan-quota probe was made.
+
+Each turn was one ordinary no-tool prompt. Raw prompts, answers, session identifiers and transcript paths are not reproduced here and the disposable directories were removed. The measurements below contain field names, counts, timing relationships and attribution only.
+
+## Native row timing and attribution
+
+`counted` means `inputOther + inputCacheCreation + output`, the hub ceiling rule. `row within turn` compares the native row time with the captured hub turn interval. `usage after turn_end` compares the hub's `usage` event time with its immutable `turn_end` event.
+
+| Attempt | Counted | Cache reads | Row within turn | Usage after turn_end | Attribution |
+| --- | ---: | ---: | --- | --- | --- |
+| 1 | 5,518 | 23,552 | yes | no | `delivery`, task 1281 |
+| 2 | 237 | 28,928 | yes | no | `delivery`, task 1281 |
+| 3 | 322 | 28,928 | yes | no | `delivery`, task 1281 |
+| 4 | 153 | 28,928 | yes | no | `delivery`, task 1281 |
+| 5 | 240 | 28,928 | yes | no | `delivery`, task 1281 |
+| 6 | 325 | 28,928 | yes | no | `delivery`, task 1281 |
+| 7 | 152 | 28,928 | yes | no | `delivery`, task 1281 |
+| 8 | 240 | 28,928 | yes | no | `delivery`, task 1281 |
+
+Every native row time fell inside its captured turn interval. Every row was collected before `turn_end`, and the `tokens` event carried the same `delivery`, task 1281 attribution and counted value as the `usage` event. This verifies current native row-time semantics and immediate attribution on Kimi 2.5.2.
+
+## AC8 verdict
+
+**AC8 is VERIFIED as amended on 2026-11-08.** The amended criterion accepts current native row-time and attribution evidence plus the production-timer delayed fixture when no delayed native row occurs. Zero of the eight ordinary turns produced a row after `turn_end`, so the immediate rows above are not presented as delayed evidence. The original delayed-native-only leg remains unobserved on Kimi 2.5.2.
+
+The production delayed path is covered separately by `test/daemon-kimi-delayed-usage.test.ts`: its real unreferenced 250 ms timer collects a post-result row without another turn, updates `usage`, `tokens`, the budget and roll-up, and leaves `turn_end` unchanged. The A/B test fires the injected scheduler while task B is open and proves that A's delayed row keeps A's attribution, increments no turn total, and that an ambiguous timestamp is `unattributed`. These fixtures establish the #1281 behavior, not a current native delay.
+
+The earlier native delay observed on Kimi 2.3.1 remains recorded in [2026-10-25-kimi-usage-ac11.md](2026-10-25-kimi-usage-ac11.md). A future version that again produces a post-result row should repeat this receipt's ordinary-turn leg.

package/docs/verification/2026-11-07-kimi-review-watch-1284.md

@@ -0,0 +1,115 @@
+# Kimi review policy watching (#1284)
+
+Date: 2026-11-07. Task #785. These are model-free private fixtures on dgx02,
+Linux x64, Bun 1.4.2. The production Kimi preparation and reviewer peer are used
+with an owned fake print/version command and synthetic OAuth files. No real Kimi
+CLI, provider, account, credential or model interaction is claimed. COMPAT and
+machine trust are unchanged.
+
+The historical baseline was measured before production optimization, at
+`4daaa842db4035c5504caff6867445b47b7c1be5`. It drives the actual old
+`ReviewerPrintPeer` interval and complete `current()` fence. Input is exactly
+1048576 framed bytes; the generated agent file is 1048868 bytes.
+
+The post-change samples below are bound to
+`dedbf4974d2a91ebd96623f4bd4a1ca04c06ac47`. The worker mode uses the real
+policy worker and new controller. Inline-reference mode uses the same full fence
+on the main thread under the new controller; it is a comparator, not another
+measurement of the historical interval.
+
+## Measurements
+
+Values are milliseconds. Authority samples are eight synchronous `reviewToken()`
+calls. Periodic samples are three checks per mode, after preparation has already
+read the private files. These are small warm-fixture samples, not a cold-start,
+production latency regression, p99 estimate or general speedup claim.
+
+| Mode | Authority mean / max | Ordinary check mean / max | Ordinary start-to-start |
+| --- | ---: | ---: | --- |
+| Historical inline interval | 1.631 / 3.011 | 1.657 / 1.776 | 100.259, 100.214 |
+| Worker | 1.709 / 3.937 | 2.748 / 2.998 | 100.362, 99.739 |
+| New-controller inline reference | 1.613 / 3.095 | 1.725 / 1.877 | 99.857, 100.511 |
+
+The worker check includes IPC and completion overhead. Work is moved off the main
+event loop; the filesystem/hash work is not eliminated. Synchronous authority
+checks remain synchronous and retain their separate measured cost.
+
+A second phase adds a synthetic 150 ms hold, separately recorded from the actual
+full-check cost. The worker is held inside its real request path until an
+independent requester receives a real loopback control response. The fixture
+checks that the underlying check has not completed prematurely. Inline modes
+block the main thread; the independent requester confirms its request was sent.
+The control server shares the actual reviewer's process/event loop. This is a
+causal control fixture, not an installed daemon's response-time trace.
+
+| Mode | Slow start-to-start | Causal shared-counter order |
+| --- | --- | --- |
+| Historical interval | 160.648, 152.533 | check start 1, check end 2, control dispatch 3, response 5 |
+| Worker | 165.924, 154.460 | check start 1, control dispatch 2, response 3, check end 4 |
+| New-controller inline reference | 162.538, 153.221 | check start 1, check end 2, control dispatch 3, response 5 |
+
+Every sample's maximum concurrent checks is one. The first synthetic sample can
+include requester coordination in addition to the nominal hold; it is not
+reported as production hash cost. Assertions use ordering, not a host-specific
+latency threshold. A fake monotonic clock separately proves that a check started
+at 100 and completed at 350 schedules an immediate overdue check at 350, then a
+fast completion schedules 400, without replaying every missed tick.
+
+The full numeric baseline output is retained in the workspace's
+`scratchpad/temp/task785-baseline-4daaa842.log`; the benchmark command emits the
+raw arrays, ordering counters and cleanup flags. The post-change command is
+`bun scripts/benchmarks/kimi-review-watch-1284.ts`, with `--inline-reference`
+selecting its comparator. Each observed run confirmed peer stop, requester join,
+profile removal and unchanged synthetic source files; post-change runs also
+confirmed policy-worker join.
+
+## Validation and ownership
+
+Both synchronous authority checks and the worker call the same complete
+filesystem checker: lexical and physical cwd ancestors, native source identity,
+executable metadata, source configuration hash, all three private-file hashes and
+all native/private auth targets. The parent adds abort/cleanup guards before and
+after an asynchronous check. No successful asynchronous result is cached as
+verdict or task-MCP authority. Version probing, fresh private homes, the two-tool
+allowlist and OAuth-lock teardown are unchanged.
+
+The worker receives a closed immutable projection of expected paths, metadata
+and fingerprints, not serialized task facts, configuration contents or inherited
+environment. It still reads the bounded files to hash them. Requests are
+serialized and replies carry only a monotonic request ID and boolean. Error,
+output, protocol and early boot failures poison the probe, including before the
+first periodic tick; error text is not forwarded.
+
+Each child/review sequence owns its watcher. Stop cancels scheduling before
+joining a blocked check, initiates worker termination even if native stop fails,
+and joins before profile deletion or confirmed input cleanup. Failed joins keep
+the owner/profile and busy state until an explicit stop retry. A late result
+cannot settle or revive a subsequent review, even for the same task and batch.
+Worker progress never touches the native inactivity watchdog.
+
+The source worker has a JS wrapper. The plugin has a separately generated,
+self-contained sidecar with the same basename. A fixture copies that sidecar
+alone into a directory containing a space and executes it without a source tree
+beside it. Both generated assets use the pinned Bun after a worktree-local frozen
+install; neither is hand edited.
+
+At `dedbf4974d2a91ebd96623f4bd4a1ca04c06ac47`, dgx02 typecheck and 75 tests
+across six files passed (514 assertions), followed by both numeric benchmark
+modes. Coverage includes actual workers, empty environment, closed projection,
+cwd/binary/config/auth changes, equal-size restored-mtime content tampering,
+atomic OAuth refresh, stop while blocked, cleanup retries, early failure,
+same-task late results, watchdog and output-limit cleanup. Existing Kimi isolation,
+privacy, two-tool and lifecycle assertions were retained. The one old fake launch
+with `watchCurrent` gained the asynchronous probe required by the new contract.
+
+Two earlier fixture failures are not passing evidence: `28b7a07c` stopped at a
+missing MCP-schema `additionalProperties:false`; `f5b5e8e2` passed typecheck and
+56 tests but four new mtime cases used sub-ms timestamps that `Date` could not
+restore exactly. The corrected fixture initializes exact whole-second timestamps
+before binding; its size, precision and refusal assertions are unchanged.
+
+Final canonical/seed/hosted-CI results are recorded at their exact tested heads
+in the PR/task. Inventory discovery was deferred once with exit 75 because three
+remote slots were occupied; no retry loop or local test/index fallback ran. No
+documentation stamp, native version receipt, model-quality claim, merge or tag
+is part of this change.

package/docs/verification/2026-11-08-agy-1.5.3.md

@@ -0,0 +1,96 @@
+# Antigravity 1.5.3 account-free compatibility receipt
+
+Date: 2026-11-08. Task #801, Refs #843. Repeats the [1.4.12 account-free procedure](2026-11-03-agy-1.4.12.md) and its [actual-launcher nonce leg](2026-11-03-agy-1.4.12-launcher-nonce.md).
+
+**Decision: add exact 1.5.3 to verified.** All four required account-free legs passed on the same installed executable. The accepted 1.4.x line is unchanged; 1.5.2, 1.5.4 and other 1.5.x versions remain refused without person trust. This is compatibility evidence, not an account/model, permission-mode or headless ACP qualification.
+
+## Exact executable and isolation
+
+- Host macOS 27.0.1 arm64, pinned Bun 1.4.2. Native `--version`: 1.5.3. Installed executable SHA-256 `5e4b545bff4a83a93354fc50c54631cf3e8cd02e1a469087af00929f3fdc4d51`, 208,900,592 bytes. No CLI install, update or downgrade was performed.
+- CLI surface used source `4b0d36639d9417b7a810175ed3c9a13d49f429c6`; hooks and actual launcher used `01b87a7cafb35e69403d9500c4136909c3741089` (a receipt-only commit; runtime and committed bundle unchanged). The native evidence precedes the mechanical verified-set change. Frozen dependencies matched agent-mem 0.22.1 and SDK 1.30.0.
+- Fresh 0700 controller roots were outside the actual home. HOME, XDG config/cache/data/state, AGENTHUB_HOME, AMEM_HOME, project, state and TMPDIR were set before hub imports. No real credentials/settings or parent agent/session/Orca markers were copied. Later controllers also started Bun from that fresh root with --no-install; the earlier worktree had no dotenv files.
+- Every agy invocation, including help/version/mcp probes and launcher preflight, used `AGY_CLI_DISABLE_AUTO_UPDATE=1` and Seatbelt. The profile reuses `src/local/sandbox.ts`, then denies typed and canonical actual-home reads/writes. Only exact agy/Bun executables, required code and private fixture paths are allowed; native egress is only the fixture provider and, for the launcher, its own control port. Port 4600 is never used.
+- Positive controls: `/usr/bin/true` and the pinned Bun helper succeed. Opening a named real Gemini config for reading and opening the installed binary with O_WRONLY, without truncation or writes, both fail with Operation not permitted. The provider connection succeeds; a second owned loopback port is denied. These are probe controls, not a claim of ordinary agy confinement.
+- The controller compares the five named real config entries, the binary hash and its directory inventory before and after. Every completed native run matched. It joins owned teardown and checks captured process identities plus private-path survivors; it never signals unknown processes. Observed cleanup is not proof against arbitrary detached helpers.
+
+## CLI surface: passed
+
+| Probe | Result |
+| --- | --- |
+| --version | 1.5.3, exit 0 |
+| --help and help | Exit 0; --continue, --conversation, --disable-slash-commands, --input-format, --output-format, --print, --prompt-interactive, --project, --remote-control and --sandbox remain present |
+| --acp and --new | Exit 2 with the expected unknown-flag diagnostic |
+| Subcommands | All twelve historical subcommands remain; acp is also present |
+| mcp list in the empty isolated project | Exit 0, No MCP servers configured |
+
+Help is on stderr (3,319 bytes), so the final collector checks both streams. An earlier collector measured stdout alone and did not prove flag presence. CLI log: private scratch `temp/task801-cli-153-streams.log`.
+
+## Synthetic plugin MCP and hooks: passed
+
+The installed native print transport used -p, --output-format stream-json and --disable-slash-commands against a loopback Gemini fixture. Synthetic hub_task_show and hub_review responses are stand-ins, never actual board reads or approvals.
+
+- Four authenticated provider requests; all fifteen declaration names match the previous receipt. Native init has 60 tools and permission_mode request-review.
+- MCP discovery, initialize, initialized and tools/list occur in order. Exactly two calls carry the expected object arguments: hub_task_show id 1; hub_review id 1, verdict approved, fixture-only note. Native call_mcp_tool retains ServerName, ToolName and Arguments, without toolSummary/toolAction.
+- Native read_file has Path, StartLine and EndLine and reads only the canary. Its result appears in the next fixture request.
+- Six phases: SessionStart, PreInvocation, PreToolUse, PostToolUse, PostInvocation, Stop; sixteen hook rows. Shared fields, invocation counters and toolCall fields match the previous procedure. Both injectSteps markers reach the later fixture request.
+- Stop is NO_TOOL_CALL, executionNum 0, fullyIdle true, empty error. Print exits 0, no stderr or signal fallback. Profile, loopback and helper controls pass.
+
+Two initial producer checks failed, and remain recorded as failed attempts. The diagnostic kept their assertions unchanged: the fixture itself sent Arguments as a JSON string, and the collector looked for system/subtype init instead of the native top-level init object. The corrected fixture sends an object, as the historical actual-hub nonce producer already did, and reads the unique init object. Exact raw arguments and request-review remain asserted. This does not claim a historical native transport difference.
+
+Final hooks log: `temp/task801-hooks-153-object.log`; producer SHA-256 `8e60b161f01e1ec06063c56a5ab710135624f0deb2cf65297baa54c4c418c2e2`; runtime SHA-256 `6a31b50060e38e5f9bc8176f086a7ad743ec9e8b0e3d58f0182ad51116ed5cc4`.
+
+## Actual launcher nonce and normal TUI close: passed
+
+One actual `ahub --live-test --project <private project> agy` session proves both legs. Native UI used a private foreground tmux 3.8 server with an explicit fresh socket and -f /dev/null; no existing tmux session, Orca window or personal profile was used. A fixed Bun-only stdin/EOF helper passed before any agent launch.
+
+The stock gate still refused 1.5.3 during the probe. The controller used typed writeTrust only at an explicit fresh AGENTHUB_HOME/agent-compat.json, verified as a 0600 owned regular file with one exact 1.5.3 entry. Actual version assessment was trusted, not verified. This fixture waiver enabled a candidate test; it did not qualify the version or modify machine trust.
+
+The scratch Registry claim used its own PID/signature, project and instance. Daemon memory/native capture/sync, inference, triage, research, specs, snapshots, schedules, gateway URLs, MLX and Pi auto-start were off. Parent fetch was limited to the two owned loopback ports; native had the Seatbelt fence above. Provider requests require the synthetic fixture-key, refuse Origin and are body/count bounded. No real account or cloud model was used.
+
+| Observation | Final result |
+| --- | --- |
+| Managed plugin during TUI | hooks.json, mcp_config.json, plugin.json, bound to this instance/launch by actual agyMcpReady |
+| Fixture privacy checkbox | unchecked observed before continuing; folder trust applies only to the private fixture |
+| Provider requests and declarations | 4; declaration counts 0, 12, 15, 15 |
+| Actual MCP read | one call_mcp_tool for agent-hub_agent-hub/hub_inbox |
+| Nonce provenance | RAM-only producer value placed only in the scratch bus preface, never argv, env, prompts or receipt; nonceAfterInbox: true in a later provider request |
+| Peer identity | canonical agy only, no agy shadow session |
+| Normal close | /exit and Enter; normalExit: true, native/launcher exit 0, resume command observed, no native signal fallback |
+| Cleanup | all three managed files removed, bystander plugin/rule hashes unchanged, peer offline; a new begin/end control pair proves slot release, not a second TUI launch |
+| Processes and handles | interactive tree, daemon, provider, Registry claim and Registry closed; controller removed its private root; final owned-process inventory clear |
+| Real config/binary | five named entries and binary/directory inventory unchanged |
+
+The parent-JS external/unrelated fetch-attempt counters were zero. This is not a count of every native network attempt; native egress is constrained by Seatbelt. CLI/print command bound is 25 seconds; TUI total is 80 seconds with one 45-second normal-close window.
+
+Prototype launcher attempts stopped at setup barriers, used owned fallback cleanup and are not normal-close passes. An ANSI byte-window collector could not reconstruct checkbox partial repaints; the final collector reads tmux's current screen. The first tmux run also waited for daemon idle before MCP lazy attachment, preventing the second prompt; the corrected producer uses the actual TUI input screen there. It still requires actual nonce readback, canonical identity, normal close and cleanup. No native/product permission or timeout was relaxed. An initial lexical /var versus canonical /private/var fixture mismatch was fixed in the controller; its unconfirmed first failure stage is not native evidence.
+
+Final launcher log: `temp/task801-launcher-153-lazy.log`. Its source/bundle/private producer fingerprints follow; original historical producers were rehashed unchanged.
+
+- Bundle SHA-256: `333975a6aeec1413cf5ae30d6bb292c7318362f795230db8e0d5133b7d144d1e`.
+- interactive-bridge.ts SHA-256: `d87cb1db044cf1c036f7a41b06bf3023ab8d0b81e957e0302b154d54656d8348`.
+- interactive-session.ts SHA-256: `f8a06759abead1629998593d57c0cfac69f5d488e44a0d88b549fe0d9a92febc`.
+- tmux-session.ts SHA-256: `6b2f6f9216a3e2f2c3a6d4c5950b7bfe24a7162d0a331356b855ce04287253e0`.
+- tmux-helper-control.ts SHA-256: `a13c7a4b1702be7f667857eee0fd9f805c16441fd0f0b9e44ce1b7d962c76373`.
+- launcher-nonce.ts SHA-256: `55ff4db3462ad185dde17cc31ef971422e022f5ec8ce2940e4045501964c1ac1`.
+- runtime.ts SHA-256: `6a31b50060e38e5f9bc8176f086a7ad743ec9e8b0e3d58f0182ad51116ed5cc4`.
+- run-probe.py SHA-256: `16c6f4b1026250685097089f31c4b2d450d91589fa78dfa6c5f9b5c260efb5e5`.
+
+## Named real Gemini config inventory
+
+Only these five entries were hashed; contents are not published.
+
+| Relative entry | Before and after SHA-256 or absence |
+| --- | --- |
+| `antigravity-cli/settings.json` | `ad07119c21cf14ea153eb4200d6468add57d4e26783808f384f4bf7d4df31682` |
+| `config/config.json` | `b8c51361bf83a00ae5e38b3108b48ffa3b4cfc7c4e9d9b7d16e04f74725f3c14` |
+| `config/mcp_config.json` | `d8e397af03b5b032f21d0aa967086f0c78b33c87b76f2e9898ae0a144df7de02` |
+| `config/import_manifest.json` | Absent |
+| `settings.json` | `66c879018049d90632634790fe0b0eae54616a144e594c5db1b40b7c8be8c7b9` |
+
+## Reused evidence and limits
+
+The [exact reviewed 1.5.3 ACP T0 record](https://github.com/STAIxBWLB/agent-hub/blob/1e6da1ee221acd601fa28201c8cd0081d8214566/docs/verification/2026-11-08-agy-acp-t0.md) covers account-free initialize. Its isolated session/new returned Authentication required. Its other run used an existing personal login and is not reused as account-free qualification. Neither run substitutes for the native legs above.
+
+No real account, real model tool choice, native permission-mode mapping, headless ACP prompt/cancel, IDE or Linux behavior is qualified. The native probe's Seatbelt does not add a hub sandbox to ordinary agy. Fresh reviewer MCP and agy's implementer/verifier role ceiling are unchanged. The harness manifest keeps its historical procedure and autoAdmit false; no workflow, global trust or verified stamp is changed.
+
+The source PR adds only exact 1.5.3, updates receipt/trustNote and keeps the 1.4.x line. Canonical DGX and hosted CI results belong to their exact committed heads and are reported separately in the PR/task submission. No release or live upgrade is claimed.

package/docs/verification/2026-11-08-agy-acp-t0.md

@@ -0,0 +1,56 @@
+# agy acp T0 capability probe (agy 1.5.3)
+
+Refs #1280 (P2), #485. Model-free: `initialize` and `session/new` only, no prompt, no credential read. Run with `AGY_CLI_DISABLE_AUTO_UPDATE=1`.
+
+Two runs: run 1 under the person's real home (a mistake against the planner ruling, cleaned up below) and run 2 under a disposable HOME (the isolated run of record).
+
+## Run 1 (person's home, cleaned up)
+
+The person's existing login was in scope, so `session/new` succeeded and created session state. Exactly these files were created by the probe and removed; nothing else in that home was touched:
+
+- `~/.gemini/antigravity-cli/conversations/<sessionId>.db`
+- `~/.gemini/antigravity-cli/brain/<sessionId>/` (empty `scratch/` and `.user_uploaded/`)
+- `~/.gemini/antigravity-cli/log/acp-server-20261108_000903-24787.log` and `acp-server-20261108_000951-32157.log`
+
+An `implicit/*.pb` file with a nearby mtime is not referenced by the probe's log and was left alone.
+
+## Method
+
+- `agy --version` prints `1.5.3`.
+- `agy acp` on stdio, newline-delimited JSON-RPC 2.0.
+- Request 1: `initialize` with `protocolVersion: 1` and empty `clientCapabilities`.
+- Request 2: `session/new` with `cwd` set to a scratch directory and `mcpServers: []`.
+
+## Run 2 (isolated HOME, the run of record)
+
+`HOME` and `XDG_CONFIG_HOME` pointed at a fresh temp directory, no account. `initialize` answered exactly as in run 1 (same capabilities and `authMethods`). `session/new` was refused: `{"code":-32000,"message":"Authentication required"}`. The process wrote only under the temp home (`.gemini/config`, `.gemini/antigravity-cli`: state, installation id, one `acp-server` log, builtin plugins); the directory was removed afterwards.
+
+Finding: `initialize` needs no login; `session/new` and everything after it need one of the four `authMethods`, so a hub-owned headless `agy acp` needs a person-provided login or API key and cannot be probed beyond `initialize` without one.
+
+## Observed in run 1 (person's home)
+
+- `initialize` result: `protocolVersion: 1`, `agentInfo` `Antigravity ACP Server` `1.5.3`.
+  - `agentCapabilities.loadSession: true`.
+  - `promptCapabilities`: image true, audio false, embeddedContext true.
+  - `sessionCapabilities`: `resume`, `close`, `load`, `list`, `additionalDirectories`.
+  - `_meta.antigravity`: `tier`, `systemPrompt.append`.
+  - `authMethods`: `oauth-personal`, `oauth-business`, `gemini-api-key`, `agent-platform`.
+- `session/new` result with the person's existing login: a `sessionId`, `models` (13 ids, `currentModelId` `gemini-4-argon-medium`), `modes` (`default`, `accept-edits`, `plan`; current `default`), and `configOptions` `model`, `thought_level`, `mode`.
+
+## Maps onto the hub's ACP surface
+
+- Native modes `default`, `accept-edits`, `plan` map one to one to the hub's `ask`, `accept-edits` and `plan` permission modes.
+- `session/resume`, `session/load` and `session/close` exist, so the hub's restore path (`restoreArgs`) can resume an agy session by id.
+- `additionalDirectories` gives the hub a way to scope extra roots without a TUI flag.
+- `models` and `thought_level` are selectable through `configOptions`, so `launch.model` can be passed through.
+
+## Not proven here (blockers for wiring `AcpPeer`)
+
+- No prompt was sent, so these are unverified: `session/prompt` streaming shape and `stopReason` values, `session/cancel`, mid-turn steering, `session/request_permission` payloads and their option ids, and `usage_update` or token fields.
+- Whether `agy acp` honours the managed hooks (`hooks.json`) or a separate approval path; the TUI hook floor (#1280 P1) may not apply to ACP turns.
+- Whether `mcpServers` passed to `session/new` load the hub MCP server for a headless peer.
+- Authentication of a hub-owned process: run 2 shows it is required; how the hub would supply it without reading a credential is open.
+
+## Decision
+
+Probe receipt recorded; `AcpPeer` wiring for `agy` stays out of this change. Wiring needs one authorized model-backed turn to prove the prompt, permission and cancel legs, which the person must approve (it spends quota). Follow-up: a task for the model-backed receipt, then the `ahub agy --mode headless` and `ahub watch agy` wiring.

package/docs/verification/2026-11-08-hub-visual-1058.md

@@ -0,0 +1,161 @@
+# Hub visuals evidence, #1058
+
+This records task #709 evidence by exact head. The published 0.1.7 fixture and isolated browser legs passed below; the final canonical gate and hosted CI are recorded separately. Live observations were recorded by Codex and do not turn synthetic guard coverage into native all-peer qualification.
+
+## Checks by head
+
+- `cc7b89c3f664dc08b5f9c2563ea258de22a68bc5`: DGX typecheck and focused tests passed, 177 tests, 0 failures, 2,601 assertions across 11 files. Evidence: scratchpad `temp/task709-focused-cc7b89c3f664dc08b5f9c2563ea258de22a68bc5.log`. This is focused evidence, not the canonical changed gate at the final head.
+- `2bbd9b67b3b70b6f67cfed2f4476d288ab73af33`: bundle built using pinned Bun 1.4.2 and a frozen install. Generated bundle SHA256: `64e96449215a395efa8c9b99bcf525ce7eced256764705223c065aaba5d017c3`. Source provider SHA256: `ea41d5aeb7f871e3fe856d5bfabfb4c869966e6dfa75006baad40f047e171989`.
+- `cfeb1d2913bb`: the first canonical DGX changed gate selected the full suite: 12,709 pass, 101 skip, 5 fail across 986 files (12,815 tests; 318,515 assertions), exit 1 in 2,205 seconds. Typecheck, inventory, bundle freshness and package checks passed. Failures were the read-only MCP tool inventory, two registry guard assertions on a config object literal, task detail section expectations and an extracted role-visibility fixture missing its new UI dependency. Corrections preserve existing assertions; this is not a green gate. No current-invocation daemon leaks were found.
+- `f823646789b5e6f3022cfb38b6c617c9a89862e7`: correction-focused DGX typecheck plus 84 pass, 0 fail, 652 assertions in six files. Its subsequent full run was intentionally interrupted via the owned remote_dev SIGINT cleanup after the independent recovery finding made that head obsolete (exit 130 after 1,568 s). It is not a green full gate or a resource deferral.
+- `d4b52acb59a2f8f6922bf2ed47778cbf21ba00f2`: held-recovery retention correction, DGX typecheck and 20 pass, 0 fail, 182 assertions in two files. The new fixture retains an expired-on-target row unchanged while held, releases with matching digest, then confirms normal pruning after release.
+- An inventory-only DGX command at `2bbd9b67` stopped before checking classifications because its disposable tree had no frozen dependency install (`ts.ScriptTarget` unavailable). The canonical gate performs that install first. Final inventory and canonical committed-head validation are pending; no canonical pass is claimed here.
+
+## Actual acon observation
+
+Two isolated runs used real acon 0.1.3, the source provider and production daemon with a synthetic peer, six visuals per run. The final run is bound to `2bbd9b67b3b70b6f67cfed2f4476d288ab73af33`; its body-free counts, hashes and cleanup are in scratchpad `temp/task709-live-2bbd9b67-e.log`. Codex viewed `temp/task709-acon-render-e.png`.
+
+- Comparison `<b>` and table `<i>` text remained inert.
+- Two valid 74-byte, 2 by 2 PNG assets returned HTTP 200 and matched their expected hashes. Before SHA256: `1fe7e0db6305cd87580a13d22dde4e6fa6efea01abab2de43f0d23fdde4e9e26`; after SHA256: `500f9b69351abec04ae9956400cc6406f640b596a4ada1e2e1a58e15d6ae4845`.
+- Replacing the after PNG caused HTTP 502 with a safe System cause and next step; changed bytes were not served.
+- Malformed Mermaid showed a notice and source fallback. Valid Mermaid reached the five-second fallback. Successful SVG rendering was unverified in these historical 0.1.3 runs.
+- The final log records six posted visuals, two fixture PNGs, one mutation and zero external fetch attempts. Its `sharedCases: 4` counter counts the four candidate cases exercised; it is not evidence of a published shared fixture. Codex operated the browser, checked the actual DOM and viewed the screenshot; `browserAssertions: 0` is the temporary harness counter, which does not count those separate browser checks.
+- Own provider, console server, tools, console, synthetic peer, daemon, registry, handles and external browser were closed; the process exited without forced stop and its scratch root was removed. Owned sockets were closed.
+
+No account, native agent or model was used. No standalone hub UI browser was used. Initial a/b/c preflights failed at the scratch routing MLX guard before listeners were opened; no production guard or bound was changed to make them pass.
+
+## Boundaries and remaining evidence
+
+- Validation rejects malformed or oversized payloads, screens text and preserves cleared extra table row keys. Tool paths and stored asset references have distinct shapes. Fake source-guard coverage is not a live privacy or native-role receipt.
+- Assets remain bound to guarded file identity, hashes and current privacy authority on reads. The changed-PNG observation covers one actual asset mutation path.
+- Unbound visuals expire after the configured retention period (default 30 days); task-bound records remain unless task existence proves them orphaned. Recovery inventory hashes stored metadata and payload/file-reference JSON, not image bytes. Focused fixtures cover corruption refusal, cursor cleanup, retention and archived reset separation.
+- Historical 0.1.3 observations did not qualify WebP: that host and 0.1.4 refused its MIME type. The published 0.1.7 follow-up is recorded separately below.
+- Historical fixtures were hub-owned candidates with source provenance. They did not fill the shared-fixture gap; the 0.1.7 follow-up imports the published cases directly.
+- The ordinary peer transports were covered by source/fake checks, not native all-peer journeys. Such native journeys are not an additional acceptance requirement in the issue. Fresh-reviewer MCP intentionally remains exactly hub_review and hub_task_show under D2. Mermaid SVG success was unverified in the historical 0.1.3 run; the 0.1.7 observation below records successful rendering. D4 still explicitly permits a five-second source fallback.
+
+The earlier planner ruling recorded AC1 unmet after the agent-console#78 handoff refusal, and AC4 unmet while agent-console#81 had no published support. Those were not waived. Published support and the 0.1.7 follow-up results are recorded below. Successful Mermaid SVG was unverified in the historical 0.1.3 evidence and is verified by the isolated 0.1.7 observation; standalone browser rendering remains unverified. D4 permits source fallback.
+
+Completed overlap work was checked: main contains Kimi delayed usage (#783), AGY count-only hints and person attribution. Their imports, immutable turn attribution and shutdown cancellation are preserved; none replaces visual authority or generation checks. Open #800 ownerAttachment stays display-only, and #802 rememberOutcome remains separate from visual capture. The current main merge includes only already-merged work; no peer branch is imported. Final committed-head canonical validation is separate and remains pending until its result is recorded.
+
+## Published dependency follow-up
+
+Primary recheck on 2026-11-08 found agent-console#78 and #81 completed and npm 0.1.7 published. The exact devDependency and lock now adopt 0.1.7. The upstream VISUAL_CASES module is imported directly, never copied: 42 cases, with six fixed, documented valid-acon/stricter-hub cap differences. Missing alt still refuses and now names the precise alt field. Old candidate provenance remains historical 0.1.3 with a separate 0.1.7 recheck; it is not labelled canonical. Type-only production imports preserve the dependency boundary.
+
+Earlier AC1/WebP unmet observations above describe the 0.1.3 evidence. They are superseded by the following direct fixture and browser observations, not solely by an upstream issue state or package version.
+
+- Frozen source head `afc1e459447a779a2418457640b80fda5c0eafb3`: DGX frozen install, typecheck and focused checks passed, 142 tests, 0 failures, 630 assertions across seven files, exit 0 in 37 s. Log: scratchpad `temp/task709-017-focused.log`. The canonical test imports all 42 published cases and checks six explicitly named stricter hub-cap differences.
+- Real acon 0.1.7 loaded the actual source provider and production daemon in an isolated HOME/project, with a synthetic ordinary peer and no account, native agent, gateway, memory sync or model. It posted seven visuals, including four normal cases selected from the actual published module, two software PNGs and one software WebP. Published case module SHA256: `68455a97595664d88fc62567a301ef5e5e06abf78b75145f528a38b5c5bf39b6`.
+- Both PNGs returned HTTP 200, `image/png`, inline disposition and the same 74-byte hashes recorded above. The 38-byte WebP returned HTTP 200, `image/webp`, inline disposition and SHA256 `ea6a0dfbc1103e231f69d8a08182ac8168f9aa06242f1d1606a9e82894a45e40`. All six displayed image elements decoded to 2 by 2 pixels after scrolling into view. The browser's lazy loading was respected, not disabled.
+- The normal flow rendered A -> B in the sandboxed frame. The malformed flow showed "The diagram could not be drawn, so it is shown as text" with its original source. Codex viewed screenshots `temp/task709-acon-017-flow.png`, `temp/task709-acon-017-webp.png` and `temp/task709-acon-017-fallback.png`. The 2-pixel fixtures establish decoding, not useful image-layout quality.
+- Replacing the after PNG returned HTTP 502 and the safe System cause/next step "visual asset changed since posted or no longer allowed; post the visual again using a current public file". No changed bytes were served.
+- One scratch HTTP URL builder encoded the plugin reference's @ and therefore received 404; the actual console-generated route was correct. Direct HTTP readback used that route spelling. No production URL or provider code was changed to make the check pass. An initial generic CSS scroll matched an earlier figure; selecting the actual last figure exposed the expected deferred renderer and fallback. Neither observation is counted as a product failure or silently omitted.
+- Body-free log `temp/task709-live-017-f.log` records seven posts, four published cases, two PNG fixtures, one WebP, one mutation and zero external fetch attempts. `browserAssertions: 0` remains the harness's counter; separate browser DOM/readback and viewed screenshots supply the browser evidence. It records provider/server/control clients/synthetic peer/daemon/registry/handles closed, owned process exited without forced stop, browser closed and scratch root removed. The separate owned browser socket directory had no open handles and was removed.
+
+These observations complete the previously missing shared-fixture and WebP legs. The standalone dashboard remains covered by extracted UI/fake-host checks rather than a browser run, and native all-peer journeys remain unrun. The final canonical committed-head result and exact-head hosted CI are still pending here; no full green gate is inferred from the focused or browser checks.
+
+
+## Final review corrections and pending gate
+
+Independent preflight found and verified fixes for held-recovery retention, the old host WebP refusal, and the advertised path-side alt schema. At `47b291c696d1461fa38a9d3682389879b0af783e`, alt remains required and bounded but may be empty, matching the published case and runtime. The regression checks both accepted empty alt and refused missing alt. DGX frozen install, typecheck, inventory and 143 focused tests passed (0 failures, 633 assertions across seven files; exit 0 in 37 s). Inventory was OK: 3,534 entries, 2,529 classified, unchanged 1,005-entry baseline. Log: scratchpad `temp/task709-alt-focused.log`. The pinned Bun bundle was regenerated.
+
+The canonical run at `1ee364c3dc9c473cb3e8fa12c974e72740dc13a6` was stopped via the verified owned remote_dev helper's normal SIGINT cleanup after that schema finding made its source obsolete (exit 130 in 62 s). No pass or resource deferral is claimed. The final report head starts one fresh canonical `scripts/check.sh --changed` run; its result is not yet available here. Exact-head hosted CI remains a merge gate.
+
+A separate O3 full gate at `45b5dca1` exposed a pre-existing main fixture assumption in `test/herdr-companion-platforms.test.ts:85`: it expects `/home/dev` not to exist, but that is the DGX container HOME. That fixture is unchanged in this branch. It is reported to the conductor rather than edited in this visual feature. A failure from that assertion must not be presented as a green canonical gate.
+
+
+## Review correction: metadata snapshots and refusal classes
+
+The review at `687d579f` found two Important defects: operational refusal causes
+were collapsed into a privacy message, and periodic snapshots re-read and
+re-screened up to twenty full payloads. This revision separates operational
+recovery, role, membership, observer, shutdown, authority, storage, concurrent
+change, screen-unavailable and policy-unavailable diagnostics. Sensitive privacy
+hits retain uniform wording. An unknown or throwing screen still fails closed;
+its error body is never returned.
+
+Snapshots use the store's metadata projection plus bounded file-path metadata,
+never `get` or `payload_json`. Relevant raw policy bytes and accepted path arrays
+key a narrow policy projection; no full `loadConfig` runs on this path. Current
+accepted restrictions remain unioned with the normally merged candidate path
+rules, and each read still checks exposed title/from/task/path metadata. Explicit
+show rechecks the complete payload. Missing files keep their public explanation;
+the guarded asset read alone decides current existence and hash.
+
+The same revision makes all three prune sites wait for both recovery holds,
+uses a nonmutating `Limiter.peek` before expensive validation/screening/reads and
+retains one final consuming admission, admits explicit `to: "user"`, and removes
+visual-only calls from task-progress evidence. Three moved limiter inventory
+keys keep their original labels; the baseline is unchanged.
+
+Structural tests cover twenty tiny and maximal-table rows, forbid full payload
+reads, use corrupt/oversize body canaries, preserve metadata privacy, and assert
+peek's bucket/repeat/group state never changes. Cause tests use real daemon
+operations for reachable states and a real tools request under prepared recovery.
+Stopping and stale child-authority branches execute the actual extracted closure
+with all later ports forbidden; these are unit evidence, not native-child
+qualification. New exact-head test results follow when available.
+
+The obsolete canonical run at `687d579f` was stopped through its verified owned
+remote_dev helper's normal SIGINT cleanup after this review (exit 130 in 701 s),
+not counted as a pass or deferral. No duplicate run was started.
+
+
+The first review-correction run at `0df8749a61accff31bdbce806f9c95d73d68f37e`
+passed typecheck and inventory, then had 247 pass and 3 fail (1,351 assertions,
+ten files; exit 1 in 45 s). New fixture assumptions caused the three failures:
+an initially off-roster peer is refused at hello before its tool call; closing
+the journal also activates a recovery hold; and `settings_reload` returning
+`ok: true` can be an unconfirmed preview, not adoption. The corrections preserve
+cause/next-step and zero-effect assertions, and confirm configuration adoption
+before releasing the held call. This run is not a green gate. The independent
+read-only preflight found no new Important code issue in that delta; the generated
+bundle was excluded from its 14-file source/test/doc coverage.
+
+
+Subsequent focused runs preserved those assertions while correcting the roster
+fixture: `0bef303c` had 249 pass, 1 setup failure (1,367 assertions, ten files;
+46 s), `3b6dcf19` had 33 pass, 1 setup failure (291 assertions, one file; 35 s),
+and the single-case `bb93351f` run failed on the fixture's status lookup (4 s).
+The real roster API saves membership even when the passive fake cannot prove a
+native stop; its explicit unconfirmed-stop result is asserted rather than
+replaced with fabricated stop evidence. Effective settings rows, rather than a
+removed peer's status entry, confirm the saved membership.
+
+Once that setup reached the actual call, `39a75723` exposed a further product
+path: the outer WebSocket membership guard returned only "codex is off roster"
+before the visual handler, so the next-step assertion correctly failed (one
+case, 4 s). The outer stopping and prepared-recovery guards were also traced.
+Visual requests now receive the same operational guidance at those boundaries,
+without changing any admission condition or non-visual response. Assertions were
+not weakened to accept the incomplete message. Full native-child stop/identity
+qualification remains outside these passive and extracted-unit fixtures.
+
+
+At `1388cbaa06f0682124b3e8f6a3824259985a5c42`, DGX frozen install,
+typecheck, inventory and all 253 affected tests passed: 0 failures, 1,395
+assertions across ten files, exit 0 in 45 s. Log: scratchpad
+`temp/task709-revision-check.log`. This includes the actual off-roster request,
+prepared recovery requests, outer stopping branches, metadata-only large-table
+checks, missing-image behavior, limiter nonmutation and existing configured MCP
+read-only tests. Earlier failing fixture/setup runs are retained above rather
+than represented as passing.
+
+The rewritten outer roster message is also an exact seeded anchor. Its
+`roster-request-fence` search/replacement now matches the new line while retaining
+the same false-membership mutant and original named test. The affected seed is
+in shard 29/64; that shard and all-anchor readback are checked separately before
+submission. No claim about the entire 559-seed gate is made by a focused shard.
+
+
+At `7893068fa88e4ae536311141e48c7fa38c782439`, all 559 anchors matched
+exactly once. The affected shard 29/64 passed all nine original-green /
+named-mutant-detected pairs, including `roster-request-fence`, in 24 s.
+Log: scratchpad `temp/task709-seeds-29.log`. The mutant still replaces only the
+membership predicate with false; its original named test is unchanged. This is
+a focused seeded shard, not a claim that all 559 mutants ran.
+
+The final report-only head has the same runtime and test bytes as these passing
+heads. A fresh canonical `scripts/check.sh --changed` run starts at that final
+head; its result and hosted full CI are not yet observed. AC6 remains a merge
+gate. No timeout, retry, assertion, privacy fence or baseline was relaxed, and
+no real profile, release or deployed hub was changed.