@staix/agent-hub 0.34.1 → 0.35.0

package/docs/verification/2026-11-07-compat-python-startup-1248.md

@@ -0,0 +1,51 @@
+# Bounded Python receipt-helper startup (#1248 T1)
+
+Date: 2026-11-07. Task #775, Refs #1248. Hosted [measurement run 42361191648](https://github.com/STAIxBWLB/agent-hub/actions/runs/42361191648). Exact measurement source: `e9e10b8f1130d02dd5c9907ddc2507671a3e2d25`.
+
+All 12 planned artifacts are present: three fresh hosted-VM jobs per OS/helper mode. Source SHA, committed helper SHA-256, flags, replicate identity, runner OS/architecture, metadata scalars and all helper/refusal outcomes validate. This follow-up selects an 8000 ms helper allowance from this complete series and the larger prior completed CI observation below.
+
+| OS / architecture | Actual mode | Cold ms, replicates 1 / 2 / 3 | Cold max ms | Warm samples | Warm max ms |
+| --- | --- | --- | ---: | ---: | ---: |
+| macOS arm64 | output-check (-I) | 1067.451583 / 1435.647209 / 1578.762166 | 1578.762166 | 15 | 131.304500 |
+| macOS arm64 | extract (no -I) | 1187.909083 / 1129.775667 / 2032.190459 | 2032.190459 | 15 | 101.507000 |
+| Ubuntu x64 | output-check (-I) | 26.032033 / 20.150258 / 24.773280 | 26.032033 | 15 | 27.823435 |
+| Ubuntu x64 | extract (no -I) | 33.736413 / 23.114327 / 34.226551 | 34.226551 | 15 | 32.182228 |
+
+Counts: 12 cold, 60 warm, 12 refusal controls and 12 later interpreter metadata invocations, 96 total observations. Censored: 0. Errors: 0. Refusal controls: 12/12 expected exit 2. No failed or censored observation was dropped.
+
+## Binding and procedure
+
+- Output check uses the exact committed `write-output.py` with production `-I` and an inherited owned directory capability at FD3. The occupied-output refusal is unchanged.
+- Extraction uses the exact committed `extract-archive.py`, without `-I` as production does. Node zlib creates the tiny public regular-file ustar before the first Python execution; the traversal archive is a separate refusal control.
+- No Bun/npm installation, setup-python, native agent, account, model, or interpreter metadata probe precedes the first helper. Warm samples and refusal controls precede the interpreter metadata invocation.
+- The controlled launcher records its first Python invocation; no claim is made that the OS/image caches were absolutely cold. Each child has a 15000 ms measurement ceiling and 4096-byte output cap. A timeout would remain right-censored; none occurred.
+
+| Helper | SHA-256 at measured commit |
+| --- | --- |
+| output-check | `a6e056a59506922d4e15765495cec6e15cc33568ad6fdf90f5cc30c7b344217b` |
+| extract | `7daf837943d279f2e72ca7e03cc8e6ea3c0bc9ab1eda6db738f20d57045c7eb3` |
+
+| OS | Interpreter | Runner image |
+| --- | --- | --- |
+| darwin | CPython 3.9.6 | macos15 20261104.0514.1 |
+| linux | CPython 3.12.3 | ubuntu24 20261101.360.1 |
+
+## Eight-second sizing tradeoff
+
+The complete series has maximum cold time 2032.190459 ms (macOS extractor replicate 3). The separately recorded completed CI extractor sample remains larger: 3835.40 ms in [run 42355168440](https://github.com/STAIxBWLB/agent-hub/actions/runs/42355168440), macOS shard 1/4; it is not one of these 12 samples and is not discarded. Twice that known completed sample is 7670.80 ms. The selected 8000 ms helper allowance is 2.0858 times that prior sample, leaving 4164.60 ms beyond it.
+
+The direct output-check maximum is 1578.762166 ms; using the larger extractor tail to size output-helper startup is a conservative shared-interpreter allowance, not a claim that the writer itself took 3835.40 ms. Both helper modes were measured explicitly.
+
+Keeping two individually bounded output operations means `RECEIPT_OUTPUT_MS = 16000` ms. Existing controller aggregation includes that value automatically, increasing its advertised worst-case output allowance by 12000 ms from the former 4000 ms. The production 180000 ms installation allowance remains unchanged. Only the archive test fixture reuses one helper allowance for both totalMs/installMs.
+
+Eight seconds reduces false timeout risk at the cost of allowing a genuine helper hang to block up to eight seconds per operation, rather than two. The finite timeout, kill/reap behavior, FD/no-follow, collision, ownership, integrity and explicit timeout assertions must remain intact. No unbounded warm-up is proposed. Three cold samples per cell do not estimate a statistical p99 or guarantee all future runner tails.
+
+All 12 records were reviewed before the bound changed. The temporary measurement workflow was restored in `c4a40cee`, before normally merging origin/main at `3e27f16c`. The permanent measurement module remains callable; the scheduled compatibility workflow is unchanged by this follow-up. No package, real home, account, model, machine trust or agent CLI was installed or used. This receipt is not a native compatibility qualification.
+
+## Regression checks and evidence limits
+
+The output test retains every FD, ancestry, collision, no-follow and content assertion and changes only the exact total-budget contract from 4000 to 16000. A temporary helper uses `exec /bin/sleep 3` to exceed the former two-second allowance and finish. A second uses `exec /bin/sleep 60`; the actual eight-second spawnSync timeout must report `timeout`, reap that same owned helper process and publish no output. Both tests retain an explicit 20-second outer hang guard. No forked background helper is created. The generic npm fixture remains at 3000 ms installation budget; explicit timeout and archive-integrity controls are unchanged.
+
+Committed-head DGX checks and hosted CI are separate from the measurement run and are reported at their tested SHA in the task/PR. They are not inferred from these hosted timing observations. No verified stamp is refreshed.
+
+Per-observation elapsed/censor/outcome/exit fields are retained in the hosted per-job `measurement/result.json` artifacts and the workspace-local `task775-measurement-e9-complete/validated-complete.json` projection. No raw helper stdout/stderr, private paths or environment values are included in this report or the validated projection.

package/docs/verification/2026-11-07-compat-receipt-harness-1248.md

@@ -0,0 +1,105 @@
+# Model-free receipt harness core (#1248 T1)
+
+Task #763. This report describes the harness and its fake-only verification. No
+agent CLI was installed or run on the Mac, and no account or real model was used.
+The T0 manifest and existing runtime admission policy are unchanged.
+
+## Command and artifacts
+
+`bun scripts/compat-receipt.ts <id> <exact-version> --out <new-owned-directory> --disposable-runner`
+validates the id/version and refuses unsafe or occupied outputs before install.
+It also requires a GitHub-hosted runner or disposable Linux container. A personal
+Mac is refused; a temporary HOME alone does not contain installer code. The
+explicit flag acknowledges that the runner must be destroyed after the job.
+Each run creates fresh HOME, XDG, cache, prefix, project and native tool homes.
+The caller's account/model variables and agent/Orca markers are not inherited.
+The worker is started in that environment before native proof API imports.
+
+Public exact npm artifacts are byte-verified against SRI before npm receives the
+local tarball; npm user/global config and cache stay private. Tagged release
+assets are checked against SHA-256 metadata and a checksum before extraction.
+The two-pass extractor rejects traversal, links, nonregular entries, duplicates,
+excess entries and expanded bytes before writing. This is not an assertion of
+kernel confinement of arbitrary package lifecycle code. No ignore-scripts flag
+is used to make installation or a proof succeed.
+
+`summary.json` records identity, actual OS/architecture, artifact integrity,
+installation and each manifest leg's closed status/cause/next step, time bounds,
+scoped owned-stop status, lifetime process cleanup with its reason, disposable
+runner containment and eligibility. `receipt.md` is its human view. Neither contains raw
+native output, caller secrets or temporary prefix paths. Unproven lifetime cleanup or failed owned stop keeps
+the private workspace and reports its location only on stderr. No version,
+line window, real-home trust or PR is changed by the harness.
+
+## Proof reuse and conductor ruling
+
+Conductor ruling 2026-11-07 confines T1 to committed producer code. Historical
+scratch Kimi/Qwen/Jcode producers are not copied or promoted here. Their missing
+native legs report exactly "producer not committed; see follow-up task". Pi's
+historical committed top-level producer is not an import-safe candidate API, so
+its remaining proof reports that extraction gap. Source/lifecycle semantic review,
+unsupported native platforms, account/model and TUI work are explicit not-run.
+None can become a pass merely because installation or configuration succeeded.
+
+- Codex imports `codexReviewerBackend.prepare` in the isolated worker, using only
+  temporary exact-version fixture trust. Empty/ambient preparations and their
+  structured isolation assertions must pass before its internally executed
+  metadata/native-canary checks can pass. The returned model exec is never run.
+  A candidate already admitted by policy cannot reproduce its old pre-admission
+  negative check without changing policy, so that leg is not applicable.
+- Kimi imports its existing prepare and task-bound MCP broker. Only actual private
+  config/inventory/environment and host broker-refusal assertions are mapped.
+  Native Write/tool-loop/network/child-cleanup legs remain not-run. Production
+  managed-provider validation is not relaxed or pointed at a loopback service.
+- Claude imports the existing Python producers through runpy. Optional
+  --expected-version and --runtime-path inputs parameterize the candidate and
+  isolated interpreters while preserving historical defaults/assertions. A group
+  must exit 0 with exact cases, version, binary stability and its native/host
+  group assertions before those assertions pass. These assertions do not prove
+  lifetime cleanup of detached helpers. Producer cleanup legs retain their pass or
+  fail on this original group evidence. PID groups are never signalled after their
+  reaped leader may have been reused. Original historical producer fingerprints
+  are history, not hashes of these newly parameterized files.
+
+## Bounds and evidence ceiling
+
+Install/proof execution has monotonic scheduling deadlines; default budgets are
+15 minutes total, 3 minutes install and 2 minutes per proof worker/group. A fixed
+10-second teardown allowance and a 4-second output check/publication allowance
+are included in reported total wall-time bounds; elapsed time is sampled before
+publication. The
+production owned-process/descendant teardown is reused with a credential-free
+process-table observer. Unconfirmed owned stop or a detected survivor fails the run.
+Lifetime cleanup is separately reported as unproven, never inferred from an empty
+leader PGID. Per the corrected ruling, this reported property does not gate
+eligibility or rewrite producer cleanup assertions: outcome pass, policy eligibility,
+confirmed owned stop and no detected survivor are the admission conditions.
+An inconsistent optimistic pass/timeout result is rejected.
+
+The test suite uses fake package metadata/bytes, fake installers and fake proof
+executables. It covers pass plus both outputs, failed proof and no PR, pre-dispatch
+model refusal despite an optimistic response, leg and total timeouts with owned
+descendants, private environment/no caller mutation, unsupported platform,
+invalid exact inputs, symlink outputs, digest-before-effects, bounded safe archive
+extraction, committed producer mapping and isolated-worker missing-producer refusal.
+The adversarial cleanup fixture launches a detached helper with a new PGID and
+ignored pipes, then exits its launcher with code 0. The helper can remain alive
+when the original group is empty. T1 reports `processCleanup: unproven` with a
+reason, preserves owned-stop checks and fails any survivor it can detect. A passing
+producer cleanup leg can remain pass and the receipt can be eligible while harness
+lifetime cleanup is unproven; the test suite covers that distinction. It does
+not install a Linux subreaper or macOS supervisor. Disposable runner lifetime is
+the containment boundary; workflow integration must destroy the VM/container.
+A process-supervision follow-up is required for lifetime proof.
+
+The output regression renames the output parent and substitutes a symlink during
+a run. A retained verified directory descriptor plus dir-relative exclusive
+no-follow writes prevents final artifacts from reaching the replacement target.
+These are harness/host fixture results, not new native CLI compatibility receipts.
+
+## Verification
+
+Final committed-head dgx02 checks and hosted exact-head CI are recorded in the PR
+and task submission. No local full suite, native agent installation, account,
+real API key or model run is claimed. Producer promotions and workflow/publisher
+integration remain outside this PR; T2 publisher integration follows the person's separate token decision.

package/docs/verification/2026-11-07-compat-receipt-producers-1248.md

@@ -0,0 +1,96 @@
+# Committed Kimi and Qwen receipt producers (#1248 T1b)
+
+Task #765 promotes the first-party historical producers behind the Kimi 2.5.1
+and Qwen 0.26.8 receipts into callable modules. Candidate executable/package paths
+and versions are parameters; no personal installation or account is an input.
+The harness worker imports these modules instead of embedding their proof bodies.
+No COMPAT, trust, workflow, verified version or documentation stamp changes.
+
+## Provenance
+
+Every retained producer matched its receipt fingerprint before promotion.
+
+| Receipt | Historical producer | SHA-256 | Committed owner |
+| --- | --- | --- | --- |
+| [Kimi 2.5.1](2026-11-06-kimi-251-reviewer-compat.md) | `agent-hub-748/kimi-probe.ts` | `2ff8e2841f2cbd58d07add57e5deb9041ee33a692489083a176e6b5d5f406edf` | `scripts/compat-receipts/proofs/kimi.ts` |
+| Kimi 2.5.1 | `agent-hub-748/loopback-only.cjs` | `f4e4714ac846c9e1861306f19c1c656350d1d4180818bd834aa34d1ae0ced8df` | `proofs/kimi-loopback-only.cjs`, original bytes |
+| Kimi 2.5.1 | `agent-hub-748/run-kimi.py` | `1822f6d597d4b4cd7128d451addf81cb7bcd67492f339ea363ba99b288f80f5e` | Native process ownership is now the shared bounded command port |
+| [Qwen 0.26.8](2026-11-06-qwen-0268-acp.md) | `agent-hub-749/probes/qwen-acp-probe.py` | `897ff1b615f93da8cf5d0a93a5ce150eadfc55e87dce1d44625ad833c236691f` | `proofs/qwen-acp.py` |
+| Qwen 0.26.8 | `agent-hub-749/probes/qwen-permission.mjs` | `d777feb9070f254238f5ecf57f510e6af88e817b559919f65160bfd7db02a154` | `proofs/qwen-permission.mjs` |
+| Qwen 0.26.8 | `agent-hub-749/probes/deny-network.cjs` | `361148af658dd4b65ed35308622ec99bb882ec5a25fab54581776546f139e892` | `proofs/qwen-network.cjs`, original bytes |
+
+Historical paths are relative to workspace `scratchpad/temp/`. These hashes bind
+the original procedures, not the newly parameterized module bytes. The promoted
+Python/MJS helpers are import-safe and invoked by the single Qwen module.
+
+## Receipt-to-leg mapping
+
+Kimi's "Isolated production and native controls" is split at the existing
+preparation boundary. `reviewers.ts` still owns preparation, exact inventory,
+environment decoy, task-bound broker and source-fixture cleanup. An optional native
+callback runs before broker revocation; negative broker controls compare their
+callback count against the preceding positive native calls.
+
+- `native-tool-loop`: fixed loopback SSE drives the actual two-tool loop, requires
+  the exact advertised two-tool inventory and the expected broker callbacks.
+- `write-absent`: injected Write is absent and produces native tool-not-found;
+  the marker stays unchanged.
+- `write-positive-control`: the private agent explicitly gains Write; fixed replies
+  produce the marker and the positive request sequence.
+- `network-guard-control`: the original preload's non-loopback positive control
+  must deny the synthetic attempt. This is application-level, not kernel isolation.
+- `cleanup`: original synthetic config/credential bytes, current launch, native
+  group stop and per-case temporary removal remain assertions. Synthetic provider
+  fields reproduce the original fixture; no real OAuth exchange occurs.
+
+Qwen's "Native ACP, no prompts" and "Actual published permission handler" remain
+canonical Python/MJS procedures behind `qwen.ts`.
+
+- `artifact-private-install-integrity`: private package/name/version/CLI binding
+  and original CLI/chunk/metadata byte fences supplement the controller's SRI.
+- `native-acp-auth-session-modes`: initialize, session and the four mapped mode
+  transitions. Receipt-observed protocol, title, auth, default mode and fixture
+  model are now explicit assertions; extra unmapped modes are permitted.
+- `actual-published-permission-handler`: exports-only copy beside the original
+  published chunk, native approval handler and exact options, allow-once,
+  cancellation and unoffered-option refusal; original chunk bytes stay unchanged.
+- `preload-network-cleanup`: original preload plus positive control, no permission
+  fixture network attempt, and bounded native-group cleanup observations.
+- `native-macos-repetition`: passes only on actual macOS arm64 after the native
+  controls pass. `additional-linux` never substitutes for that requirement.
+- `reviewed-optional-lifecycle-replay` remains human source-review work, not a
+  successful install inferred as a lifecycle review.
+
+Cleanup never signals a group after its leader was reaped. Producer group
+assertions retain their original meaning. Harness lifetime cleanup remains a
+separate reported property under disposable-runner containment; it is not an
+admission gate. Detected survivors and unconfirmed owned stop still fail.
+
+The [Jcode 0.99.1](2026-10-26-jcode-0.99.1.md) producer was not retained:
+`/tmp/ahub-jc0991` is gone. Its legs remain `producer-not-committed`; reconstruction
+and proof against the 0.99.1 control are a separate task, not a promotion here.
+
+## Verification and limits
+
+Tests use typed fake command/protocol ports and private fixture homes, without a
+mocking library. No native agent CLI is installed or run on the person's Mac, and
+no real account, API key or model is supplied. Fixed loopback messages and tokens
+are synthetic controls, not model behavior or provider readiness.
+
+Exact committed-head dgx02 checks, hosted CI and review-thread state are recorded
+in the PR/task. A successful fake protocol suite proves wiring and refusal
+behavior, not a new native compatibility receipt or verified version.
+
+## Review corrections
+
+Both Qwen preload arguments quote their guard path. A fixture relocates the four
+canonical helpers beneath a directory containing spaces and Korean characters,
+then exercises both actual preload denial controls, ACP and permission handling.
+The guard bytes and all existing refusal assertions stay unchanged.
+
+In [CI run 42355168440](https://github.com/STAIxBWLB/agent-hub/actions/runs/42355168440),
+the first macOS archive extraction completed in 3835.40 ms and the next in
+454.92 ms. The archive fixture now uses its existing 5000 ms total budget for
+installation, so its former 3000 ms margin does not mask an integrity refusal.
+Production deadlines, the npm fixture and the explicit timeout assertions are
+unchanged. Exact-head checks for these corrections are recorded in the PR/task.

package/docs/verification/2026-11-07-compat-workflow-1248.md

@@ -0,0 +1,94 @@
+# Automated compatibility receipt workflow (#1248 T2)
+
+Task #764 extends the existing drift watcher with structured candidate data,
+isolated per-ID proof jobs and a data-only publisher. This report describes the
+implementation and its fixture evidence; it is not a native CLI receipt.
+
+## Trust and credential boundaries
+
+- The watcher reads the trusted COMPAT policy and manifest. Public version strings
+  must be exact safe versions before they enter JSON matrix data. Unknown sources
+  remain drift without a runnable version. Confirmed verified IDs are separate
+  structured data, used to clear their old managed issue blocks.
+- The matrix uses the manifest OS, at most eight IDs and two concurrent jobs.
+  Unspecified OS is not guessed. Each hosted runner has `contents: read`, no
+  supplied secrets, `persist-credentials: false`, a 20-minute bound and explicit
+  `--disposable-runner`. Native processes receive the harness's private homes and
+  allowlisted environment. Receipt artifacts remain data, not publisher code.
+- Trusted read-only preparation validates native summaries against the manifest,
+  strips untrusted prose, and retains only canonical statuses, identities, digests
+  and scalar observations. Malformed or duplicate summary records make the batch drift-only; unreadable or oversized input refuses preparation.
+  For an eligible candidate it patches one row, builds repository code with pinned
+  Bun/frozen dependencies, binds fixed output files to the source SHA, then
+  restores source, plugin assets and role notice. This job has no GitHub writes.
+- The privileged publisher downloads only that preparer's immutable artifact ID.
+  It validates every descriptor/hash/source binding before effects and re-plans
+  against current bot-owned PRs. It runs Node builtins and first-party pure
+  functions plus `gh` REST, never candidate code or a package install/build.
+  `GITHUB_TOKEN` must be explicitly present; personal `gh` login is not a fallback.
+
+The [GitHub runner reference](https://docs.github.com/en/actions/how-tos/write-workflows/choose-where-workflows-run/choose-the-runner-for-a-job)
+names `macos-latest` as arm64 and hosted jobs as fresh VMs. The harness still checks
+actual OS/architecture. The [artifact action](https://github.com/actions/download-artifact)
+supports downloading by immutable ID, avoiding candidate-selected bundle names.
+
+## Publication and dry run
+
+All required legs must pass and trusted manifest policy must allow model-free
+admission. Model/TUI, source-review, unsupported-platform and missing-producer
+legs stay not-run; `eligible` supplied by an artifact is not trusted. Harness
+lifetime cleanup remains reported unproven and disposable-runner containment,
+without overriding the producer's native-group assertions or acting as an
+admission gate. A detected survivor or unconfirmed owned stop still fails.
+
+One branch `compat/<id>-<version>` holds only the exact verified-array/receipt
+edit, generated receipt and prepared plugin assets. Every other row and each
+line window stays byte-identical. Existing bot PR metadata and owned file hashes
+protect against ordinary manual drift; unknown/manual branch collisions refuse.
+Updates use append-only Git history and `force: false`, not a claimed expected-old
+SHA compare-and-swap. Editable PR markers are not cryptographic provenance against
+a person who can coherently forge repository state. No verification PR is merged.
+
+The person selected `GITHUB_TOKEN` plus explicit `check.yml` workflow dispatch.
+GitHub's [workflow dispatch API](https://docs.github.com/en/rest/actions/workflows#creating-a-workflow-dispatch-event)
+requires Actions write permission, so that permission is confined to publish.
+There are no GitHub App credentials. The replacement PR and check dispatch must
+succeed before an older same-ID PR is closed. Separate PR-only checks remain
+normal review gates rather than being claimed as dispatched by `check.yml`.
+
+The candidate CLI runs as the same user and in the same job as the harness that
+writes its receipt. A malicious release could replace `summary.json` with a
+well-formed eligible forgery before upload, which preparation's validation cannot
+detect. Eligibility is a compatibility signal, not a security attestation of the
+release. The person's PR and release review is the real admission gate; opening
+an automated PR is not permission to merge it.
+
+An exact-title tracker is selected through the existing fail-closed identity
+helper. Closed-cause per-ID blocks preserve other drift/unknown evidence and
+remove confirmed verified IDs. `dry: true` still runs the isolated proof and
+read-only artifact preparation, then prints plans with zero branch, PR, issue, label or check-dispatch mutations.
+Live publication is restricted to the trusted current main source; feature-branch
+dispatch is usable for dry validation only.
+
+## Verification
+
+Pure tests cover admission policy, incomplete/malformed input, superseding
+versions and dry plans. File-helper tests cover exact-row byte preservation and
+refusal of unsafe grammar. Preparation uses fake build ports; publisher tests use
+fake REST data to cover branch ownership, changed source/assets, two-parent main
+integration, new-day receipts, preserved human prose, dispatch-before-supersede,
+stale verified issue blocks and zero-write dry/validation modes. Workflow tests
+check permissions, no secrets/credential persistence, job bounds and artifact IDs.
+No mocking library or real token is required by these fixtures.
+
+Exact committed-head dgx02 results, hosted CI, workflow dry-run results and review
+threads are recorded in the PR/task. Unrun live/native/platform behavior stays
+unverified; no real token value, account path or model prose is committed.
+
+The real dry run [42359014165](https://github.com/STAIxBWLB/agent-hub/actions/runs/42359014165)
+completed watch, three macOS harness jobs, prepare and publish at
+`36d9059a35abeb22fd1b72423072e3bd90bebd9a`. It printed drift updates only: no
+candidate was eligible. The current implementation's PR-open, update and
+supersede write paths have not run against real GitHub; their evidence is the
+fake REST suite. Scheduled live drift writes are not claimed as exercised by
+this dry run.

package/docs/verification/2026-11-07-daemon-startup-1232.md

@@ -0,0 +1,169 @@
+# Daemon startup and pending readiness (#1232)
+
+Date: 2026-11-07. Refs #1232, task #770.
+
+The historical 11-16 second startup did not reproduce. An isolated real-state
+copy started in 2503 ms before the change and 2171 ms after it. The representative
+synthetic fixture on dgx02 took 2201 ms before and 1382 ms after. These are single
+observations, with different runtimes and different event mixes as described
+below; they do not establish a general speedup or the historical cause.
+
+The measured redundant work was three full `events.jsonl` seed reads. They now
+share one lossless streaming pass. No persistent index, migration, log rotation
+or historical-key truncation was added. The index follow-up is #1266.
+
+## Method and boundaries
+
+Each sample used a fresh isolated project and state copy. Wall time starts with
+the measured child launch and includes imports and daemon initialization through
+readiness. Copying or generating the fixture happens before that clock. The
+phase line measures exclusive boundaries inside `startDaemon`; import time is
+reported separately from those phases.
+
+The real state remained on this Mac. Its copied database used SQLite's online
+read-only backup; only the destination was normalized out of WAL mode so the
+first Bun read did not depend on missing sidecars. The event copy retained a
+complete append-only prefix. Private files and directories had private modes.
+The measured child had isolated HOME/tool homes, a loopback port allocated at
+startup, no peers, no gateway/model/sync work, and both application effect guards
+and a Seatbelt profile denying outbound networking and the original state paths.
+Storage and cache initialization remained enabled. Every successful observation
+reported zero prohibited effects, stopped its owned child and removed the copy.
+The real hub's listener identity was unchanged.
+
+The authorized three-attempt limit was exhausted, including the first failed
+attempt: it stopped before daemon startup because a freshly backed-up WAL-mode
+database lacked sidecars for Bun's read-only open. That attempt has no startup
+timing claim. A public WAL-backup regression covers the correction. Attempts 2
+and 3 are the before/after Mac observations below. No private state was sent to
+dgx02, and no task or event body was read into the model.
+
+The dgx02 fixture matches the before-copy counts and aggregate byte sizes, not
+its private contents. Every synthetic event is a native-end record, a worst-case
+dedupe-set workload rather than the real event-type distribution. Its rollup is
+cold; the real copy retains its existing rollup cursor. SQLite page padding makes
+the synthetic DB 8192 bytes larger than requested. The private `ready` phase is
+about 1.24 seconds and is not reproduced by this aggregate synthetic fixture.
+
+## Observation bindings
+
+| Observation | Head | Runtime | Wall ms | Import plus startup ms | Phase total ms |
+| --- | --- | --- | ---: | ---: | ---: |
+| Mac copied state, before, attempt 2 | `efe43fdbc62b35495a160dcf71ba119479fc12f3` | Bun 1.4.4, macOS arm64 | 2503 | 2479 | 2346 |
+| Mac copied state, after, attempt 3 | `b4ae2e66dacb80f537a55e1daef701498d117449` | Bun 1.4.4, macOS arm64 | 2171 | 2144 | 1995 |
+| dgx02 synthetic, before | `efe43fdbc62b35495a160dcf71ba119479fc12f3` | Bun 1.4.2, Linux x64 | 2201 | 2182 | 1989 |
+| dgx02 synthetic, after | `a87e3c5d7e243d350ee19dc7d38c6d792b9f7873` | Bun 1.4.2, Linux x64 | 1382 | 1362 | 1167 |
+
+| Profile | Mac before / synthetic | Mac after |
+| --- | ---: | ---: |
+| DB bytes | 38260736 / 38268928 | 38260736 |
+| Tasks / history entries | 773 / 8383 | 775 / 8425 |
+| Task text bytes | 941219 | 943364 |
+| Delivery rows / payload bytes | 2052 / 10429841 | 2052 / 10383407 |
+| Event bytes / lines | 135894851 / 723243 | 136341131 / 725816 |
+| Abandoned files / aggregate bytes | 7 / 94021653 | 7 / 94021653 |
+| Largest abandoned file bytes | 16932725 | 16932725 |
+
+The real hub continued running between copies, so its two profiles differ.
+
+## Phase timings
+
+All values are milliseconds. The phase names and numeric-only line shape are
+fixed; unavailable or regressing diagnostic clocks cannot fail startup.
+
+| Phase | Mac before | Mac after | Synthetic before | Synthetic after |
+| --- | ---: | ---: | ---: | ---: |
+| schema | 1 | 1 | 1 | 1 |
+| source | 38 | 41 | 24 | 24 |
+| configuration | 1 | 2 | 3 | 3 |
+| control | 3 | 2 | 6 | 6 |
+| recovery | 1 | 2 | 0 | 1 |
+| journal | 45 | 44 | 38 | 42 |
+| bus | 71 | 91 | 88 | 100 |
+| memory | 87 | 88 | 61 | 59 |
+| model_runtime | 0 | 0 | 1 | 0 |
+| board | 2 | 2 | 1 | 2 |
+| task_runtime | 170 | 177 | 38 | 37 |
+| native_stop_seed | 209 | 229 | 598 | 685 |
+| budget | 1 | 1 | 7 | 9 |
+| usage_seed | 223 | 36 | 535 | 79 |
+| usage_rollup | 2 | 2 | 33 | 33 |
+| token_runtime | 13 | 10 | 13 | 13 |
+| token_seed | 14 | 14 | 10 | 12 |
+| services | 14 | 15 | 25 | 28 |
+| transcript_usage_seed | 216 | 0 | 478 | 0 |
+| ready | 1235 | 1238 | 28 | 30 |
+| post_ready | 0 | 0 | 1 | 3 |
+
+The three seed calls already exist at v0.20.0 (`daemon.ts` lines 1969, 2123 and
+3277) and v0.23.0 (lines 2375, 2565 and 4123). The measurements do not show that
+these calls were introduced during the historical latency jump.
+
+## I/O and semantic preservation
+
+| I/O observation | Mac before | Mac after | Synthetic before | Synthetic after |
+| --- | ---: | ---: | ---: | ---: |
+| Aggregate event bytes read | 407685899 | 136341537 | 416073489 | 144283569 |
+| Streaming seed passes | three legacy full reads | 1 | three legacy full reads | 1 |
+| Streaming seed bytes | not separately recorded | 136341240 | not separately recorded | 135894960 |
+| Event `readFileSync` calls after the change | not separately recorded | 0 | not separately recorded | 0 |
+| Separate auxiliary event bytes | not separately recorded | 297 | not separately recorded | 8388609 |
+| Abandoned snapshot body bytes | 0 | 0 | 0 | 0 |
+
+Seed bytes include the child's new hub-start record. Aggregate I/O also includes
+the existing bounded rollup poll and the appender's one-byte newline check. Cold
+synthetic auxiliary I/O is 8 MiB plus that byte; the warm private copy reads a
+small remaining tail. Those reads are shown explicitly rather than claimed to
+be part of a single physical read of every consumer.
+
+The later benchmark-only review correction independently attributes bytes around
+the real synchronous `UsageRollup.poll` method and restores its original
+descriptor. Acceptance caps that actual rollup I/O at its existing 8 MiB budget
+and permits at most the appender's one extra byte outside the seed and rollup
+scopes. A second streaming descriptor pass outside either scope, or a full-log
+poll inside the rollup scope, is rejected. Private attempt 3 predates these scoped
+counters: its 297 auxiliary bytes are retained as an aggregate observation, not
+retroactively assigned to `usageRollupReadBytes` or `residualExtraReadBytes`.
+There was no fourth private run. The underlying daemon change is unchanged.
+
+At `33ad860f5bda`, typecheck and all 61 focused tests passed. The stricter public
+synthetic acceptance run took 1364 ms and independently measured 8388608 rollup
+bytes, one rollup call and one residual appender byte. Seed passes remained one,
+with no event `readFileSync` call, abandoned body read or prohibited effect.
+
+The shared line predicate preserves measured-time handling, malformed-line
+skipping and a complete final JSON record without a newline. Streaming UTF-8
+decoding has no line-size or history ceiling. Native-stop IDs and Claude usage
+IDs are folded during the pass, while the existing budget, Kimi and token-window
+consumers reuse the same accepted event array. Their existing expressions and
+historical keys remain intact.
+
+## Readiness behavior and checks
+
+The status promise and runtime schema are unchanged. A signed, bound own child
+that remains pending gets one stderr notice after 12 seconds. The CLI continues
+waiting, and authenticated late readiness uses the existing runtime admission
+and confirmation path once. Death, authority cancellation or the 120-second
+outer bound cannot turn unknown startup into success. An outer-bound failure
+leaves the daemon running and its runtime unconfirmed. Each connect/status pair
+gets at most half the remaining wait budget; ordinary `inspectProject` callers
+retain their API and timeout semantics.
+
+At `a87e3c5d`, typecheck, 41 tests and the representative synthetic acceptance run
+passed. At `844fbbdc0461b884b7c69234c3c4c5c05510b6c3`, typecheck and 62 tests
+passed, including actual retained-runtime lifecycle fixtures and a real owned
+fake child's signed identity. Its subsequent inventory check listed the 39 new
+keys, which are classified separately without changing the baseline or existing
+labels. Tests compare legacy and streamed seed results, long/fragmented UTF-8
+records, quota/Kimi/token semantics, actual reader I/O, repeated observer calls,
+late confirmation, cancellation, competing claims and both readiness bounds.
+
+The full canonical dgx02 gate at
+`d16e7ea18613adeb4c0705085e45f5454abf5698` passed: 12248 pass, 101 skip,
+0 fail across 953 files, with no current-invocation daemon leaks. That full result
+predates the benchmark-only scoped-I/O and cleanup corrections described above;
+their current-head delta gate and hosted CI are recorded separately in the PR/task.
+
+The pinned Bun 1.4.2 bundle was regenerated after a worktree-local frozen install.
+Final canonical gate, hosted CI and review-thread evidence are recorded in the
+PR/task. No interactive agent start or real account/model behavior is claimed.

package/docs/verification/2026-11-07-jcode-receipt-reconstruction-1248.md

@@ -0,0 +1,118 @@
+# Jcode receipt reconstruction: partial control, not qualified (#1248)
+
+Date: 2026-11-07. Task #767. This is new proof code, not promotion of the missing
+producer behind [the historical Mac receipt](2026-10-26-jcode-0.99.1.md).
+
+The isolated Linux x64 control executed the verified 0.99.1 release. Isolation,
+serve cleanup, ACP and MCP passed. Telemetry and the strict persisted-context
+binding failed. Source comparison remains not-run. These failures are retained;
+this report makes no COMPAT, trust or macOS qualification change.
+
+## Artifact and runner binding
+
+The public [v0.99.1 release](https://github.com/1jehuang/jcode/releases/tag/v0.99.1)
+provides `jcode-linux-x86_64.tar.gz`, 56203997 bytes, with SHA-256
+`0b2a612de97c6e01ae6de1c0cff555b3460cf8364d1a11d2f8649fc0c9d7a1e6`.
+The installer verified its tagged asset digest and `SHA256SUMS` before extraction.
+The archive has a 505-byte regular wrapper `jcode-linux-x86_64` and its regular
+adjacent `.bin`; their names and bytes are preserved.
+
+At `350a3d042fc9d9680fa84b90c82f5c77bd3941b7`, dgx02 ran Bun 1.4.2 in a
+disposable Linux x64 container. Typecheck and 79 fixture tests passed. The actual
+native control's installation passed with the digest above; its overall outcome
+was failure, with owned stop confirmed and lifetime process cleanup unproven.
+The container's lifetime supplies containment. The control sets `autoAdmit:false`
+in a temporary in-memory Linux projection and never spoofs its OS or architecture.
+The checked-in manifest still requires macOS arm64.
+
+The Mac archive's acquisition was checked separately on Linux without executing
+its binary: SHA-256
+`3623164d518b0c9d443ab07052084244b379e8a3377037db67d2382220f4ed14`,
+wrapper `jcode-macos-aarch64`. That is packaging evidence, not native Mac evidence.
+
+## Reconstructed procedure and observed legs
+
+The single imported module owns private HOME/JCODE_HOME, the loopback provider,
+serve/ACP children and their cleanup. Serve and ACP argv reuse production
+`jcodeCommand`; version and private-provider configuration use parameterized
+commands. The MCP entry carries no peer environment; the observer checks the
+two synthetic owned-launch markers inherited by its native child. No real native
+home, account, API key or model is supplied. The four real-home hashes from the
+historical receipt were not reproduced: only the private HOME decoys are fenced.
+
+| Leg | 0.99.1 Linux observation |
+| --- | --- |
+| isolation | pass: private environment and unchanged private decoy files |
+| serve-cleanup | pass: ready FD/socket/sidecar metadata and stopped owned groups |
+| acp-initialize-new-load-mode-ceilings | pass: protocol/identity/new/load and both unsupported-method checks |
+| mcp-owned-environment | pass: actual eager child inherits the two expected markers |
+| active-turn-soft-interrupt | fail: strict private persisted System-carrier binding was not established |
+| telemetry | fail: `telemetry_id` appeared in the private native home |
+| source-comparison | not-run: scoped source investigation is not the historical full compare review |
+
+`session/load` still omits `sessionId`. The existing withheld recovery guarantee
+and `requireLoadSessionEcho` policy are unchanged.
+
+The fixed-stream loopback turn reached ping capability, same-session subscribe,
+idle/active state, non-urgent interrupt acknowledgement, `end_turn` and two
+completion bodies. Closed observations classified the first request as native
+context plus original prompt, and the second as context, original, streamed head
+and steer. Those observations do not substitute for the failed persisted-role
+assertion. The final code also counts every completion POST attempt, rejecting a
+third attempt even when its body is refused by the two-body storage cap.
+
+## Narrow context and lock rules
+
+Pinned source
+[session.rs](https://github.com/1jehuang/jcode/blob/7206efd0c1dbf49ef38d06b63f3a96a3a7cee611/crates/jcode-base/src/session.rs#L989)
+and [prompt.rs](https://github.com/1jehuang/jcode/blob/7206efd0c1dbf49ef38d06b63f3a96a3a7cee611/crates/jcode-base/src/prompt.rs#L656)
+define the hidden user/System-display session-context carrier. The allowed
+exception requires the new private session's matching ID and working directory,
+a first stored `role:user`/`display_role:system` text carrier, the exact reminder
+frame and seven field names, and identical bytes once at the same position in
+both provider requests. Only that carrier may be excluded. Duplicate, forged,
+changed-field, extra-field, moved or app-sentinel carriers fail. Application
+original/head/steer bytes, order and all generic extra-user negatives remain
+strict.
+
+The Linux control failed that binding. The source also permits optional hardware
+and Git context, which the seven-field rule does not admit. That is a possible
+platform-dependent limitation, not a diagnosis proved by the closed failure
+checkpoint. Snapshot/journal coverage is not inferred when the role binding is
+unavailable.
+
+Today's 0.99.1 control creates an empty `telemetry_id.lock`. The proof treats only
+that exact zero-byte, regular, single-link, run-owned file in the private native
+home, with `JCODE_NO_TELEMETRY=1`, as coordination rather than telemetry data.
+Non-empty, symlink, hardlink and wrong-location locks fail; identity, event and
+milestone artifacts still fail. The same control subsequently detected
+`telemetry_id`, so the telemetry leg remains failed. File presence does not prove
+that telemetry was transmitted.
+
+We cannot tell whether the original 2026-10-26 producer saw the empty lock,
+ignored it, or whether it did not appear then. The historical receipt is unchanged
+and is not claimed to cover this allowance.
+
+## Acquisition and runner corrections
+
+The real control exposed three shared harness defects:
+
+- GitHub release metadata rejected `Accept:application/octet-stream` with HTTP
+  415. Metadata now requests JSON; archive/checksum requests retain binary content
+  negotiation and every redirect, checksum and pre-effect integrity check.
+- The archive wrapper is platform-qualified rather than named `jcode`. An
+  optional trusted recipe executable basename selects its unique existing file;
+  traversal, links and paths outside the verified prefix remain refused.
+- A nested command runner counted its own proof worker's private request path as
+  a survivor. Only that current PID is excluded from the path heuristic. Known
+  descendants and other private-root processes remain detected, and lifetime
+  cleanup remains unproven. A separately owned helper negative verifies that the
+  observation never grants authority to signal it.
+
+The metadata regression failed on dgx02 before its correction. Header-sensitive
+and executable-selector fixtures retain all archive, timeout and integrity
+negatives. Protocol fakes exercise the application/role/context/telemetry and
+third-request refusals; they are not native-version qualification evidence.
+Diagnostics contain bounded closed labels, booleans and counts only, and are
+never admission data or native content. Final committed-head gate and review
+evidence are recorded in the PR/task.