@staix/agent-hub 0.34.0 → 0.35.0

package/docs/verification/2026-11-08-jcode-0991-model-setter-1317.md

@@ -0,0 +1,143 @@
+# Jcode 0.99.1 headless ACP model setter
+
+Date: 2026-11-08. Task #809, Refs #1317 AC4. **Passed:** native setter APIs and
+the actual owned `JcodePeer`/DB-latch path in a fixture with no TUI client.
+This does not qualify a shared native TUI binding or failover concurrency.
+The production Jcode capability remains disabled pending that form restriction.
+This is compatibility evidence, not a security attestation or account/model run.
+
+## Exact artifact and setup
+
+- macOS arm64 installed Jcode reports 0.99.1, v0.99.1 (7206efd0c).
+  Its 142,887,552-byte executable has SHA-256
+  `eccb33c08a21764317b0e0bf217e60c745b90f51c7bf6d2ff90b548b9fe7383e`.
+  A single byte-identical private executable copy is checked before/after;
+  no dependency tree or personal native home is copied.
+- Native `jcodeCommand`, owned-group helpers, `JcodePeer`, `ModelOverrides` and
+  `ModelOverrideLatches` are the actual first-party implementations. The passing
+  adapter/latch source is `7c86077e89f790af0fd444b8ca9bd90e8d0bc09f`.
+- Fresh 0700 temporary roots hold HOME, JCODE_HOME, cwd, TMPDIR, all XDG and
+  hub/tool homes. Empty native/project MCP files, `JCODE_DISABLE_CLAUDE_MCP=1`,
+  `JCODE_NO_TELEMETRY=1`, `--no-update` and `--no-selfdev` avoid account/import/
+  updater paths. No configured account, key or actual model is used.
+  Telemetry-file absence is not claimed; all native writes remain isolated.
+- A native `provider add` creates one no-key OpenAI-compatible fixture profile,
+  default model `receipt-model-a`, pointing only to an owned ephemeral loopback
+  server. The integration fixture additionally declares `receipt-model-b` in
+  that same private profile's models array before startup. Endpoint, auth and
+  default A do not change. This matters: without catalog opt-in or explicit B,
+  the native default advertises static A only, even though its raw setter can
+  accept B. The probe never pretends that an unused GET model list was consumed.
+
+## Native isolation controls
+
+Every native command uses Seatbelt from the existing local-worker profile plus
+owned paths. Actual-home data and installed-runtime write-open are denied.
+Native TCP is limited to the exact fixture provider port; an owned decoy port
+is denied. Only the owned server/debug Unix sockets are allowed. No port 4600,
+actual gateway, public provider, real key or native account is used.
+
+The Rust HTTP runtime needs the named
+`com.apple.SystemConfiguration.configd` lookup. A separate create/release control
+returns a NULL dynamic-store handle without it and a valid handle with it,
+without querying or changing configuration values. The final profile adds only
+that service; file and network negative controls still pass. No OS/security
+setting, file limit or deadline is changed.
+
+The provider rejects Origin, credentials, unknown paths, oversized bodies,
+unexpected models and excess completion calls. It emits bounded fixed text SSE,
+never tool calls. Client filesystem/terminal capabilities are false. Owned
+processes and groups are stopped and observed gone. Detached lifetime
+containment is still unproven, not a disposable-runner attestation.
+
+## Native APIs and actual adapter behavior
+
+The raw protocol leg initializes exact `jcode` 0.99.1/protocol 1 and creates a
+session. While fixture request A is held, both `session/set_model` and
+`session/set_config_option` refuse with the native processing-a-prompt error.
+There is still only request A. After normal A completion, legacy set_model B
+acknowledges with configOptions and the same-session config update; the next
+request uses B. Standard set_config_option A then produces request A. Launch
+argv remains A on both serve and ACP, with wire sequence `[A, B, A]`.
+
+The separate integration leg uses the actual `JcodePeer` and its owned serve/ACP
+children, with the same profile and fixed launch A. A transparent observer calls
+the original request method with unchanged arguments and returns the same
+promise; it records only bounded method/model IDs, not replacement responses.
+
+1. Initial native advertisement proves baseline A and advertised B. The runtime
+   requires exact 0.99.1 identity/receipt plus existing Jcode compat admission;
+   native advertisement alone cannot grant a capability.
+2. A real DB override A enters the first deliver. The provider holds A's stream.
+   Writing desired B while busy sends no setter or second model request.
+3. A completes unchanged. The next deliver sends standard
+   `session/set_config_option`, `configId: model`, value B. Native B completes,
+   and the actual latch reports B applied. The private provider config hash is
+   unchanged immediately after B, not merely after a later restoration.
+4. Clear removes the DB intent. The next deliver sets the original baseline A,
+   the provider observes A, and latch status is A with no desired/pending value.
+5. Three prompts have accepted/completed receipts, two standard model setters
+   have exact values `[B, A]`, and the same owned serve/ACP launch is stopped.
+   Provider config remains byte-identical after stop. The actual installed
+   executable and selected actual config snapshot remain unchanged for the leg.
+
+The fixture native profile, CLI argv and synthetic responses are all declared
+before effects. No `jcode_cmd`, `-m`, provider-profile or credential configuration
+is made live by the runtime override. Actual hub CLI/dashboard authority is
+separate unit/integration evidence, not claimed as a native journey here.
+
+## Shared TUI limitation
+
+The ACP child checks its own `prompt_running`. The shared native server protects
+an ordinary stream with an Agent mutex, but deferred model mutation is not a
+logical TUI-turn fence. The pinned source's failed-attempt/failover retry path
+releases and reacquires that mutex; a queued mutation can run in between.
+[SetModel/deferred mutation](https://github.com/1jehuang/jcode/blob/v0.99.1/crates/jcode-app-core/src/server/provider_control.rs#L723),
+[streaming lock](https://github.com/1jehuang/jcode/blob/v0.99.1/crates/jcode-app-core/src/server/client_lifecycle.rs#L3925)
+and [failover boundary](https://github.com/1jehuang/jcode/blob/v0.99.1/crates/jcode-app-core/src/server/turn_failover.rs#L156)
+are source inspection, not a native failover execution receipt.
+This fixture has no TUI client and does not qualify that concurrency path.
+No TUI-bound live setter is enabled from this receipt without a separately
+reviewed form/ownership restriction. No native load-session recovery ceiling
+is relaxed; 0.99.1 still does not echo the restored session identity.
+
+## Failed attempts and real-home observations
+
+Two earlier raw attempts failed before serve readiness, with zero provider
+requests/setters, confirmed owned stop and unchanged per-leg actual config.
+The diagnostic attempt captured Rust system-configuration's NULL-object panic.
+The isolated dynamic-store control identified the precise missing named lookup;
+the final fresh raw run kept every assertion and bound and passed with it.
+Private logs from the failed attempts are retained.
+
+After the successful actual-peer run, the controller was accidentally invoked
+again before its earlier completion was checked. Exclusive native-home creation
+refused with EEXIST before any new native command. The first immutable structured
+result is preserved; the duplicate stdout redirect overwrote that stdout log,
+so the passing structured file, not the later log, is the authoritative artifact.
+No duplicate native run or config restore was performed.
+
+The selected actual Jcode/Kimi config/credential snapshot is nine entries,
+with symlinks recorded without following. The actual-peer leg matched before
+and after with digest
+`d5e53329f27db1df63c90c6f475049b8df13611d3913ec09b7589a1e6d580997`.
+Other probes observed Kimi credential drift between legs, before their native
+spawn; writer attribution is unproven. There is no task-wide immutable-state
+claim across those intervals, and no real file was restored or edited.
+
+## Evidence and remaining scope
+
+Private workspace scratch `temp/task809-jcode` holds the producers;
+`temp/task809` holds the controllers and closed case bindings/results.
+
+| Item | SHA-256 |
+| --- | --- |
+| raw Mac producer | `22259a94a7e568f9570dbfcee3e8ed85075bb72cd8031c87492f58ba4c0e00b2` |
+| actual-peer producer | `c75c04dcc374d1a8ed7cf7223693e975e481a9b104200ed1912ac5fd732ddcca` |
+| actual-peer controller | `4a801a8d5471274ef6269144a2d98c1ee7053808cba4d540229bd5ea511d793f` |
+| actual-peer structured result | `502bc53ef01e2f38462ab92387dd343788a636dfa38301753635f090930d196a` |
+
+Native TUI/failover, other platforms/providers/versions, real accounts/models
+and installed-hub rollout remain unverified. Source checks, canonical DGX and
+exact-head hosted CI are separate PR gates. No COMPAT/trust widening, verified
+stamp, release or production model change occurs in this task.

package/docs/verification/2026-11-08-kimi-252-model-setter-1317.md

@@ -0,0 +1,137 @@
+# Kimi 2.5.2 headless ACP model setter
+
+Date: 2026-11-08. Task #809, Refs #1317 AC4. **Passed:** the installed artifact's
+headless ACP setter changed A to B and restored A after clear;
+the running A turn was not changed. This is a model-free compatibility receipt,
+not a security attestation, reviewer isolation or provider/account qualification.
+
+## Artifact and admission
+
+- Installed standalone macOS arm64 CLI: 2.5.2, 182,590,912 bytes, SHA-256
+  `ae3fa721a361a2c9e9b6b3960560d1572a0bca6a8d1407e2017e6b70f80e7f97`.
+  A byte-identical private executable copy was verified before/after execution.
+  Native `--version` and ACP initialize both confirmed 2.5.2. The embedded Web UI
+  contains an older 2.5.1 string; it is not this receipt's version evidence.
+- The headless peer retains its existing native identity admission. The setter
+  additionally requires an exact receipt-backed 2.5.2 policy, the current owned
+  process/session and a valid model advertisement/baseline. No other version is
+  admitted by this receipt. `kimi-review` retains its separate COMPAT and
+  isolation gate, without this capability or a 2.5.2 verified-version change.
+- Native adapter/latch source was committed at
+  `1b67f69db720bc7d6feaedd5ca71abbfaad50e3a` for the original A/B leg, then
+  `771117140fd7a314db0e7af79623cffe7d3c04c4` for the A/B/clear/A leg after
+  merging the updated T1 base. The probe instantiates the actual
+  `AcpPeer`, `ModelOverrides` and `ModelOverrideLatches`; it does not substitute
+  protocol responses. A transparent observer records bounded method/model IDs,
+  calls the original request with unchanged arguments and returns its same
+  promise. This is not a real dashboard/CLI or full-daemon native journey.
+
+## Isolation
+
+A fresh owned 0700 fixture beneath `/private/tmp/ahub-809-...` supplies HOME,
+KIMI_CODE_HOME, TMPDIR, cwd, empty MCP and every XDG/tool home before production
+imports. The environment is an explicit allowlist, not inherited accounts,
+session markers, proxy credentials or personal settings. The two private models
+`fixture-a` and `fixture-b` reference the same synthetic managed provider and
+fixed loopback Anthropic endpoint. Synthetic file-backed OAuth data supplies
+only `synthetic-access-only`; the installed transport sends that value as
+`X-Api-Key`, with no Authorization or Cookie. No actual account or model is used.
+
+The provider binds 127.0.0.1 on port 0, caps request bodies at 1 MiB, rejects
+Origin, wrong paths/auth and excess requests, and emits fixed text SSE only.
+There are no generated tools. ACP advertises no filesystem/terminal client
+capability; every native permission request is denied, and the observed count
+was zero. No reviewer agent-file allowlist or native tool-isolation claim is
+inferred from this ACP run.
+
+Every native launch is wrapped in Seatbelt using the existing local-worker
+profile plus exact owned paths/port. Actual-home data and installed-binary
+writes remain denied. Controls prove private-provider TCP succeeds, an owned
+decoy port is denied, a named actual config cannot be read and the installed
+binary cannot be write-opened without truncation. The only extra runtime service
+is `com.apple.FSEvents`, needed for the native workspace watcher. An installed
+runtime preload control observes a private-file watcher event with that service;
+without it the same control reports EMFILE. No file limit, security setting,
+production permission or deadline was raised.
+
+The reused Node loopback guard is supplementary. The kernel port controls are
+the network boundary; an empty application log alone is not proof that no call
+was attempted. Process lifetime containment beyond observed owned cleanup
+remains unproven; this native run is not a disposable-runner attestation.
+
+## Observed next-turn procedure
+
+1. `initialize` returns protocol 1, name `Kimi Code CLI` and version 2.5.2.
+   `session/new` returns a session and model config option with current A and
+   both exact fixture choices. The adapter proves its process binding and
+   immutable baseline A.
+2. The private DB stores A, and actual `AcpPeer.deliver` sends the first prompt.
+   The provider sees `fixture-a` and holds a fixed text stream behind an explicit
+   release barrier. The adapter remains busy.
+3. The DB is changed to B while A is held. Latch status retains effective A and
+   reports desired B/pending next turn. The request observer sees no model
+   setter; the only provider request remains A.
+4. The fixture releases A and observes its normal completion, without cancel or
+   restart. On the next deliver, the adapter sends exactly one
+   `session/set_config_option` with `configId: model`, value `fixture-b` and the
+   bound session. Production parsing validates the response/config update.
+5. The second fixture request uses `fixture-b`. The prompt completes normally
+   and the latch reports B applied, with no pending revision. The exact observed
+   effect order through B is prompt, config setter, prompt.
+6. Clear removes the desired DB row. Status initially retains effective B with
+   pending next turn. The third deliver sends the original baseline A through
+   the standard setter, then the actual provider receives A. Final status has
+   effective A, no desired override and no pending next turn. The complete wire
+   sequence is `[A, B, A]`, with setter values `[B, A]`, three normal outputs,
+   zero cancels, zero turn failures and zero permission calls.
+7. Private config, device, MCP, synthetic credential and copied-binary hashes
+   match immediately after B, after clear completes and after owned stop.
+   Successful cleanup removes only the owned fixture.
+
+The original A/B leg passed first. A fresh three-prompt leg then retained every
+original assertion and the same 50 s operation/10 s stop budgets, extending only
+its exact expected request count from two to three. Existing provider/account
+configuration, launch argv and the person's real native home are not changed.
+
+## Real-home checks and failed attempts
+
+The selected actual config/credential snapshot has nine entries, with symlinks
+recorded without following. The passing probe's before/after digest is
+`297927630977dddf707dce6dd4af9cd561a38dcc2d42e3c2027f7660dba1d094`
+for the original A/B leg, and
+`938c4047672ae8a1144c45ffa9946653b1ed692c6edcba23d9b5f1919b3ff069`
+for the A/B/clear/A leg.
+The installed original binary is unchanged. There was credential-file drift
+between earlier metadata/probes, detected before any candidate spawn. That
+failed pre-spawn guard is retained, and no actual file was restored or edited.
+Writer attribution is unproven; there is no task-wide unchanged-state claim
+across those intervals. Each executed leg keeps its own before/after check.
+
+Two earlier native attempts failed before any provider request or setter, with
+owned stop and per-case actual config checks passing. The diagnostic attempt
+confirmed correct initialize identity/version, then native `session/new` failed
+with watcher EMFILE. A separate controlled watcher isolated the missing
+FSEvents service. The final fresh run kept every assertion and the same 50 s
+operation/10 s stop budgets and passed after that exact service was allowed.
+The synthetic auth-header assumption was corrected from installed source before
+any native provider request, not by accepting an unknown credential after a
+failure. Failed fixtures/logs are preserved privately.
+
+## Evidence and limits
+
+Workspace scratch `temp/task809-kimi` contains the probe/factory; `temp/task809`
+contains the controller, closed logs and case bindings. The passing result is
+bound to these SHA-256 values (the final clear leg root is
+`/private/tmp/ahub-809-o_nuxlfe`):
+
+| Item | SHA-256 |
+| --- | --- |
+| native probe | `df711ffd1e712141fef96096e89676971462765a8dea95eca8acddbce249f6cf` |
+| synthetic fixture factory | `02a8e172817af815c3247a6ca4c43b888775c3cf99b0d0ca02f02428270b90a8` |
+| root controller | `a9bf78022546b9c9ebe25c63586522476527b28b3c535547d625a8f189ad59ac` |
+| closed native result | `d0b63136b705952d5f0b29ee9b2fccbd9502e0393d4f056eb0b50354da3578d7` |
+
+Real provider/model behavior, actual accounts, other providers/platforms,
+the reviewer surface and installed-hub rollout remain unverified. Typecheck,
+unit tests, canonical DGX and hosted CI are separate PR gates; no pass is inferred
+from this native receipt and no verified stamp or release is performed here.

package/docs/verification/2026-11-08-kimi-tui-completion-1282.md

@@ -0,0 +1,45 @@
+# Kimi TUI completion facts (#1282)
+
+Date: 2026-11-08. Scope: exact native version Kimi Code 2.5.2 on macOS arm64, isolated Git projects and isolated `KIMI_CODE_HOME`, real model turns and the real hub control protocol. No prompt, answer, session id, task title, command or credential is reproduced here.
+
+## T0 native evidence
+
+- Ordinary turns write `turn.prompt(origin.kind)` and final `turn.ended(reason)`. A blocked first Stop produced only the intermediate `agent.turn.ended`; the final `turn.ended` and `prompt.completed` appeared only after the second Stop was allowed.
+- A real background process wrote `agents/main/tasks/<id>.json` with `status: "running"` and `endedAt: null`, then `status: "completed"` with a numeric end time. Its ordinary turn completed before the background process.
+- StopFailure produced `turn.ended(reason: "failed")` and a matching prompt failure. Interrupt produced `turn.ended(reason: "cancelled")` and `prompt.aborted`.
+- `TurnStarted.origin_kind` was `user` for person prompts and `task` for a background notification. `turn.prompt` may omit `promptId`; notification turns may also omit `prompt.completed`. The native `notificationId` or turn id is the correlation fallback.
+- TaskStarted and Notification hooks were not observed in these runs. Settlement therefore re-reads the native inventory and final turn instead of requiring a hook.
+- A launcher-scoped local plugin worked from `plugins/managed/agent-hub` and `plugins/installed.json`. Its record carries the launch id, not prompt data. Normal TUI exit removed the record and files; another plugin remained.
+- `spawnSync` blocked the launcher's control socket heartbeat. The production launcher now uses async spawn in the foreground process group.
+
+## Live implementation evidence
+
+- Ordinary person turn: one private `done`, with the correlated native turn end and no text in the completion sinks.
+- Real background `sleep 15`: no completion while the task file said running. One `done` appeared only after the task and notification turn had settled, without requiring TaskStarted or Notification hooks.
+- `hub_inbox`: a queued message was pulled and the person prompt that called the tool produced one `done`. The hub message itself opened no additional person run.
+- Earlier forced-close/restart probes produced one `interrupted` for the open run, never a duplicate on later reads.
+- `ahub results --json` exposed only ids, peer, outcome, times and `private: true`. The launch-scoped plugin was removed on normal exit and other plugins stayed installed.
+- Focused regression suites: 90 completion, agy, launcher and review-follow-up tests plus 36 full-gate failure-focused tests passed, with typecheck and bundle freshness. These covered the codec, completion flow, missing prompt ids, absent Stop/Notification hooks, unknown inventory, compat receipts and unverified-version behavior.
+- PR review follow-up: the version probe preserves a wrapper/interpreter prefix without launch-only model options. A shared-home plugin record carries its owner pid and process signature; an active or unknown owner is never replaced, and only a proven-gone owner is stale. Replacement and cleanup also share one fail-closed lock per native home, and setup failure always falls back to the plain TUI. `turn_end` is emitted for agy and Kimi native turns, a final row after the 2 s Stop deadline still settles, and an unknown task inventory no longer discards final-turn evidence. Quiet re-reads back off from 250 ms to 1 s.
+- Full Linux `scripts/check.sh --changed` at `8402dcd9c712e410f7f610e6271fe768894ac11e`: **12737 pass, 102 skip, 0 fail**, ending `check: OK`. The earlier full run's 10 failures were all fixed and re-run in the focused suites.
+- OCR delegation covered all 21 reviewable files at that head. Two preview/ownership findings were fixed with red/green plugin regressions.
+
+## Acceptance criteria
+
+- [x] AC1: blocked-Stop, delayed final output and stale-replay cases; Stop alone creates no completion.
+- [x] AC2: one unread completion only after final-turn readback and verified background quiescence.
+- [x] AC3: StopFailure becomes `failed` only after final-state readback; Interrupt is quiet; launcher loss/restart yields at most one `interrupted`.
+- [x] AC4: a real `hub_inbox` pull does not create a person-originated native turn; the person's prompt settles once.
+- [x] AC5: forged, stale, wrong-launch, wrong-session, wrong-cwd and replayed observations create no run, completion or receipt.
+- [x] AC6: active background work and unknown inventory never produce a premature `done`.
+- [x] AC7: no prompt, answer, hook error, task command or title reaches completion rows, events, logs or memory; native-person results are private stubs.
+- [x] AC8: only compat `kimi-tui` 2.5.2 enables the bridge; other versions keep existing TUI behavior with completion disabled.
+- [x] AC9: `scripts/check.sh --changed` passed at `8402dcd9c712e410f7f610e6271fe768894ac11e`, with 12737 pass, 102 skip and 0 fail. Live exact-version evidence above is complete.
+
+## Hardcoded-value calibration
+
+A fresh blind sample of 80 decided entries passed 69/80 (86.25%) after applying the published contract, external-input safety floor, operational default and test-seam distinctions. The new inventory constants were then classified; `bun scripts/inventory-hardcoded-values.ts --check` passed (3494 entries, 2489 classified, 1005 baseline).
+
+## Implementation boundary
+
+Hooks are candidates only. The daemon, current launch, native home, native session, project and current socket generation bind every observation. The transcript supplies origin and final outcome; background task files supply count or explicit unknown. Native-person results stay private. Headless ACP behavior is unchanged. An unverified TUI version or a launch without these readbacks declares no TUI settle.

package/docs/verification/2026-11-08-kimi-wire-yield-1283.md

@@ -0,0 +1,31 @@
+# Kimi sliced wire-log drain (#1283)
+
+Date: 2026-11-08. Scope: deterministic synthetic fixtures only. No personal wire log, account, model call or native session was used.
+
+## Baseline and after
+
+`scripts/benchmarks/kimi-wire-drain-1283.ts` creates three agents with the same append backlog and forces 16 minimum-sized reader slices. Baseline has no scheduler and retains the original synchronous 16-pass behavior. Sliced mode uses the daemon scheduler and a 0 ms continuation between slices.
+
+| Measurement | Baseline | Sliced |
+| --- | ---: | ---: |
+| Slices | 16 | 16 |
+| Drain wall time | 34.401 ms | 33.824 ms |
+| Longest synchronous slice | 34.373 ms | 3.296 ms |
+| Discovery calls | 32 | 32 |
+| Bytes read | 2,082,248 | 2,082,248 |
+| Yields | 0 | 15 |
+| Caught-up reports | 1 | 1 |
+
+These are one local run's raw values, not a production latency or percentage claim. Discovery and bytes are unchanged; each scheduled invocation returns after one bounded read/commit, and control traffic can run before the next slice. All 16 continuation callbacks are timed individually. The terminal offline read still drains synchronously before drop, and a failed attempt uses the bounded 250 ms follow-up instead of an unbounded 0 ms retry.
+
+## Acceptance criteria
+
+- [x] AC1: the same fixture reports before/after longest synchronous slice and discovery count, with raw values and no inferred percentage.
+- [x] AC2: a real daemon `status` request completed between two slices; the test asserts pending-slice ordering, not elapsed milliseconds.
+- [x] AC3: fault injection after reader offset advancement proves cancellation cannot discard the uncommitted slice; the delayed timer also contains an event failure and keeps its bounded retry.
+- [x] AC4: a new agent created between slices is discovered and counted by the next fresh validation pass.
+- [x] AC5: protocol, privacy, rotation, hard-link, shrunk-file, malformed-row and partial-line tests pass; earlier successful rows survive a later failure exactly once.
+- [x] AC6: concurrent cues remain serialized at one pending drain, and stop/session replacement cannot rebind the old session.
+- [x] AC7: `scripts/check.sh --changed` passed at `a9b777a947ab2636f36da704b71cae8dc157fb6e`, with 12698 pass, 102 skip and 0 fail, ending `check: OK`.
+
+Focused result: 43 tests across the benchmark, delayed-usage, daemon and wire suites passed, plus typecheck. Baseline/sliced receipt generation and the benchmark test also passed independently.

package/docs/verification/2026-11-08-live-model-override-1317.md

@@ -0,0 +1,250 @@
+# Live model override T1 evidence, #1317
+
+Task #808 implements person-owned desired model state and supported next-turn
+selection. This is source and fake-transport work. No model, real account,
+native profile, deployed daemon, release or machine trust was changed.
+
+## Contract and scope
+
+- Overrides live in the project hub.db and survive daemon restart. Runtime reset
+  clears them; retained state is bound by recovery feature/integrity admission.
+- CLI model set/clear/list is person-only, including agent-shell/live-test refusal.
+  Dashboard writes use verified settings-session identity, preview and confirmation;
+  expiry alone is not treated as a session identity.
+- The desired revision and an active turn's captured model are separate. Captures
+  happen before asynchronous preparation; acknowledgements bind their actual
+  adapter owner and turn, not a future turn id or a model string alone.
+- Conductor ruling on 2026-11-08 admits both CodexPeer app-server turn/start
+  paths. An explicit native client model wins, turn/steer is unchanged, and a
+  turn/start model becomes the native thread default. Clear removes the hub
+  override but does not invent an earlier native default.
+- T1 does not add ACP setters or native TUI authority. The supported factories
+  are host-marked; public capability text alone cannot claim a live setter.
+- Tier 3 instance/model/command/provider rules, native reviewer tool/isolation
+  fences and local budget/campus/observer safeguards remain in force.
+
+## Checks
+
+The worktree began at b97ee5af976e92b97d2eb55b8a1147908a83fac7. Local dependency
+preparation used pinned Bun 1.4.2 with a frozen lockfile (99 packages), with no
+pin or lock change. A bounded DGX structural query found ripwire unavailable in
+the image, so planning used the inspected source call sites instead. That query
+was not a compilation or test gate. Committed-head checks are recorded below
+when their results are available; no test pass is claimed yet.
+
+## Remaining evidence
+
+Focused fakes, canonical DGX and exact-head hosted CI remain unverified until
+recorded. No native/provider/model-backed run is claimed by those checks.
+
+
+## Initial committed checks
+
+- `c0640100a3ff4bf2ab583351ba6a2f26eb2290e0`: frozen DGX install then TSC
+  stopped at one possibly undefined model-boundary access. Inventory and tests
+  did not run. The guard now requires existence before comparing the owner.
+- `7ae86fcc726a70505107b11e445e8373321b8001`: the separate DGX inventory check
+  identified seven new keys. This is a failed inventory run, not a green gate.
+  No key was added to the baseline.
+
+The new thread-model cache cap, stored override count, pending preview count and
+confirmation TTL are operational limits on the hub's own retained state. Pending
+native RPC records, CLI response rows and incoming confirmation-token length
+are safety floors at input/proof-reader boundaries. The existing #844 token
+representation is reused unchanged in a pure leaf module; native adapters do
+not import the registry through instances, avoiding an initialization cycle.
+
+
+At `69974c37b53cc74bb6656b63648f6b8b07818754`, DGX typecheck,
+inventory and all 559 exact seed anchors passed. Runtime tests had 383 pass,
+3 existing platform skips and 1 failure across twenty files (3,821 assertions;
+124 s). The new Codex test requested steering after the RPC response but before
+its actual native `turn/started` observation. Its fake now supplies that barrier
+and asserts the steer uses the observed native turn id. No ownership guard,
+assertion or timeout was relaxed. The three existing #845 skips do not provide
+Linux-native sandbox evidence.
+
+Additional boundary checks before submission cover a saved override whose audit
+append fails (explicit saved-but-failed reply and readback/repair guidance), an
+older hub that advertises no model support (refusal before any model request),
+and model listings with retained removed peers. The model view has a display-only 512-row ceiling, with bounded collection
+of builtin, configured, external, active local and retained ids. Legacy native
+peer admission has no universal 64-peer cap, so a complete inventory is not
+assumed to fit. Overflow explicitly refuses list, marks model data unavailable in
+status/snapshot without breaking other fields, and leaves single-peer set/clear
+usable. No peer admission is narrowed and no truncated list is called complete. This does not raise the
+storage cap or change any existing timeout.
+
+
+The display path caches a scalar launch model only when a trusted supported
+factory registers its owner. Periodic model views do not call unsupported
+owners' recovery hooks or scan task history. The unavailable flag has fixed
+CLI/UI cause and repair guidance, and disables stale model controls.
+
+At `29f3be831399c0125ad9ea5bd4f117894505a760`, the new real fake-WebSocket
+ACK-order test reproduced a product defect: an older explicit-client ACK arrived
+after a newer hub model acceptance and incorrectly emitted `client-older` as the
+native choice. The named assertion failed normally (one case, seven assertions,
+4 s), without setup/compiler/timeout failure. This red checkpoint intentionally
+contained the new test and unchanged Codex source; other pending refinements were
+not claimed tested. Its eventual fix and green evidence are recorded separately.
+
+
+At `4e10add8e7f6ad446aaf42278ea46ceb86fc77df`, typecheck, inventory and
+all 559 anchors passed. The Codex ACK-order regression was green (139 ms),
+including unknown-default cases, with its original failing assertion preserved.
+The selected seven files had 125 pass and one new fixture failure (1,700
+assertions; 61 s): a counter included legacy status recovery-hook calls rather
+than isolating the new model view. The correction checks the model-list path
+immediately and executes the actual cached fallback projection separately.
+The legacy status behavior is not rewritten or counted as a model regression.
+
+A second named red test at `d92ea42aa1d0de528dba014b771895b672e2ad44`
+used the real authenticated fake Pi bridge and an owned process signature. It
+held the public setter return after a successful native ACK, withdrew roster
+ownership, then observed an incorrect `applied` callback before the existing
+epoch guard (expected zero, observed one; five assertions, 4 s). The source moves
+that callback after the existing post-ACK guard. Cancellation/shutdown precede
+the fixture's delivery join; the owned process is confirmed exited. This is
+synthetic host/protocol evidence, not a native account or model qualification.
+
+The new Codex steer test also uses the fake's existing file gate to hold turn
+completion until its native-id/model assertions finish, replacing a 100 ms
+completion race without changing any product timeout or shared fake behavior.
+Final unavailable banners describe bounded-read failure generically, because
+store-read failure and catalog overflow must not be confused.
+
+
+At `ded9db733f0a0b7b8fea70934d41d051afd1da94`, DGX typecheck, inventory
+and all 559 anchors passed; all 122 selected Codex/Pi/controller/CLI/UI tests
+passed (1,475 assertions, five files; exit 0 in 53 s). This includes the prior
+ACK-order red test and the invalidated Pi ACK red test. Other adapter, tier 3,
+reset and HTTP-auth tests passed in the earlier wider run; no earlier failed
+whole run is relabelled as green.
+
+Final state/UI edges add a captured-revision check for clear before its first
+ACK, and per-component draft/request generations for model confirmation. Editing
+the draft or beginning a new preview invalidates old tokens and all late success,
+error and finally effects. Preview metadata must match the exact set value or
+null clear. Server refusals retain bounded plain error/repair text through the
+existing text-only surface; unsafe or malformed replies use fixed fallbacks.
+The UI error-text ceiling is a safety floor, not a new authority or model bound.
+
+
+At `8333ffcdfe05f373a7c58fa192a4efd7123c138e`, typecheck and inventory
+passed; all 25 changed state/UI tests passed (237 assertions, two files;
+39 s). This covers pending clear before first ACK, strict draft/token binding,
+late preview/confirmation success/error/finally, and specific safe server repair
+text without claiming native application.
+
+Main `6da56c7a3cc697d9401903b827897148e05826e9` was merged cleanly for
+integration, including the #1318 macOS typecheck heap fix. The model runtime,
+adapter, CLI/UI, package, lock and generated bundle bytes are unchanged from the
+passing source checkpoint; incoming changes are Orca O2 and the CI fix. No
+unmerged fix branch is imported. Two new seeded guards target person-only model
+control and the reproduced accepted-ACK ordering defect, using existing named
+Linux tests. Their actual seeded results follow separately.
+
+
+## Integration checkpoint and remaining gate
+
+At `15cb959eab3b7e5796e3df4c50046d8447fe801c`, all 561 anchors matched.
+Seed shards 48/64 and 49/64 passed all 18 original-green / named-mutant-detected
+pairs, including both new model guards (46 s total). The separate existing
+Office/role/pet/motion/UI integration tests passed 101/0, with 140,310 assertions
+across five files (17 s). Logs: scratchpad `temp/task808-seeds.log` and
+`temp/task808-ui-integration.log`. These are focused shards, not a claim that
+all 561 mutants ran.
+
+The initial 44-file independent source/test/doc review had no confirmed
+Important finding; its CLI 30-second timeout nit was corrected to the repository
+20-second ceiling. Subsequent delta reviews covered all nongenerated changes
+and confirmed the model ACK, cached metadata and UI fences. The unavailable
+cause nit is fixed. The generated bundle is checked by the gate rather than
+claimed manually reviewed. A provisional token-newline alert was retracted
+against the actual pinned runtime and ECMAScript semantics, with no source change
+or pass claim based on it.
+
+The final report-only head starts canonical `scripts/check.sh --changed` on
+DGX. Its result and exact-head hosted CI remain unverified until recorded. The
+known inherited Herdr `/home/dev` fixture defect (#807) is outside this feature.
+No test is excluded or weakened for it. Native/provider-backed model acceptance,
+real UI browser interaction and installed-hub rollout remain unrun. No release,
+upgrade, restart or model change was performed on the person's running hub.
+
+
+## Unchanged covering contracts
+
+The parent agent-hub goal spec is unchanged: this refines existing native
+adapters and person-owned control without changing task/peer authority,
+account ownership or the deployment boundary. The owning adapter and
+architecture specs carry the new model state, turn and evidence contract.
+The bus spec is unchanged: reset clears an additional independent runtime table,
+while message addressing, queue/journal disposition, receipts, TTL, broker and
+reset admission semantics remain as before. Model selection is not a task or
+delivery effect.
+
+This acknowledgement was omitted from the first board completion. The final
+document-only correction carries the same runtime and test bytes. Canonical
+verification continues at parent `2f311bf61c6c77636aeb54a5ad249838b8ea0ee5`;
+it is not an exact-head canonical pass for the corrected document head. Hosted
+CI must verify the final head before merge. No duplicate canonical run or empty
+retry commit is introduced for this bookkeeping correction.
+
+## Reviewer regression corrections
+
+Review of `54546e9d` found two regressions the earlier focused set missed:
+the generic reviewer factory supplied a model getter to unsupported Claude and
+Kimi reviewer surfaces, and a client-forwarded Codex start rejected before any
+turn began retained its captured model choice. Both are operational regressions,
+not unavailable evidence. The corrected fixtures exercise actual daemon reviewer
+starts and rejected proxy requests followed by a corrected desired model.
+
+The original canonical run at `2f311bf6` reproduced the Claude reviewer failure
+in `reviewer-pool-daemon.test.ts`. It also reported a `#733` catch-up test failure.
+After those failures and this review, the owner interrupted that obsolete run
+with SIGINT; it exited 130 after 592 seconds. It is cancelled, not a full-suite
+pass, and no test failure is erased or counted as fixed merely by cancellation.
+
+The correction also acknowledges Pi selections only after prompt acceptance,
+and identifies a cleared Codex override retained by the native thread as
+`native thread default (was override)`. The latter describes known accepted
+history; clear still cannot reconstruct a previous thread model. Unsupported
+reviewer surfaces keep their original no-override review behavior and do not
+gain a model-setting capability.
+
+Concurrent definitive rejections drain a single bounded retirement candidate,
+including when an explicit client-model request is the last one to reject.
+Native acceptance or a native start protects the current boundary. Reused RPC
+ids remain ambiguous: their tombstone is retained until client reattachment,
+rather than treating the first response as proof all duplicate requests failed.
+No retirement callback grants model authority or overwrites an explicit client
+choice.
+
+The first correction check at `f7e84a200a494c4566f71915260f96dbf0318e5a`
+passed typecheck, inventory and bundle comparison, then reported 172 pass and
+1 fail (2,100 assertions, ten files; remote exit 1 in 76 s). The failure was in
+the new Pi acceptance fixture: its synthetic settlement omitted the required
+native generation, so the existing fence correctly ignored it. Commit
+`8f8c9794f0b71d52bca6a8983598e34968edd134` supplies the actual generation-bound
+start/settled lifecycle. It changes only that fixture, preserving every existing
+assertion, deadline and production lifecycle check.
+
+Committed-head DGX verification at `8f8c9794f0b71d52bca6a8983598e34968edd134`
+passed typecheck, inventory (3,496 entries; 2,491 classified; unchanged 1,005
+baseline entries), bundle comparison, and all 173 tests across ten files
+(2,103 assertions). This includes the original failing reviewer daemon suites,
+the actual proxy correction, concurrent rejection cases and Pi acceptance and
+rejection. Seed shards 48/64 and 49/64 passed all 18 original-green /
+named-mutant-detected pairs, including both model guards. The combined remote
+command exited 0 in 109 seconds; log: `scratchpad/temp/task808-review-final-focused.log`.
+
+The independent correction review covered all 16 nongenerated changed files
+and found the explicit-last rejection gap before verification; it was corrected
+and reread with no further finding. The generated bundle is verified by
+comparison. The final report-only head has identical runtime, test and script
+bytes to that focused-tested commit. Its canonical changed-scope gate and
+hosted exact-head CI remain separate, unverified gates until their results are
+recorded; neither the focused pass nor the interrupted earlier run substitutes
+for them. Native/provider-backed acceptance and real dashboard interaction
+remain unrun.