@staix/agent-hub 0.34.1 → 0.35.0

package/docs/verification/2026-11-07-kimi-delayed-usage.md

@@ -0,0 +1,34 @@
+# Kimi delayed usage and attribution receipt (#1281)
+
+## Scope and isolation
+
+Measured on 2026-11-07 with agent-hub source `a3de35e41ca26614108593b61de5674a960b2b95` plus the #1281 working change, and Kimi Code CLI 2.5.2. ACP initialization served protocol version 1 and agent version 2.5.2. The wire log declared protocol version 1.5.
+
+The measured process had a new disposable cwd, `HOME`, `KIMI_CODE_HOME`, `TMPDIR` and `XDG_CONFIG_HOME`. Its generated native config retained only the installed managed provider and model settings, with hooks and telemetry disabled. The installed account's credential/oauth directories and device identity were symlinked into the disposable native home without printing their contents. No personal project or prior session was read. No credential or plan-quota probe was made.
+
+Each turn was one ordinary no-tool prompt. Raw prompts, answers, session identifiers and transcript paths are not reproduced here and the disposable directories were removed. The measurements below contain field names, counts, timing relationships and attribution only.
+
+## Native row timing and attribution
+
+`counted` means `inputOther + inputCacheCreation + output`, the hub ceiling rule. `row within turn` compares the native row time with the captured hub turn interval. `usage after turn_end` compares the hub's `usage` event time with its immutable `turn_end` event.
+
+| Attempt | Counted | Cache reads | Row within turn | Usage after turn_end | Attribution |
+| --- | ---: | ---: | --- | --- | --- |
+| 1 | 5,518 | 23,552 | yes | no | `delivery`, task 1281 |
+| 2 | 237 | 28,928 | yes | no | `delivery`, task 1281 |
+| 3 | 322 | 28,928 | yes | no | `delivery`, task 1281 |
+| 4 | 153 | 28,928 | yes | no | `delivery`, task 1281 |
+| 5 | 240 | 28,928 | yes | no | `delivery`, task 1281 |
+| 6 | 325 | 28,928 | yes | no | `delivery`, task 1281 |
+| 7 | 152 | 28,928 | yes | no | `delivery`, task 1281 |
+| 8 | 240 | 28,928 | yes | no | `delivery`, task 1281 |
+
+Every native row time fell inside its captured turn interval. Every row was collected before `turn_end`, and the `tokens` event carried the same `delivery`, task 1281 attribution and counted value as the `usage` event. This verifies current native row-time semantics and immediate attribution on Kimi 2.5.2.
+
+## AC8 verdict
+
+**AC8 is VERIFIED as amended on 2026-11-08.** The amended criterion accepts current native row-time and attribution evidence plus the production-timer delayed fixture when no delayed native row occurs. Zero of the eight ordinary turns produced a row after `turn_end`, so the immediate rows above are not presented as delayed evidence. The original delayed-native-only leg remains unobserved on Kimi 2.5.2.
+
+The production delayed path is covered separately by `test/daemon-kimi-delayed-usage.test.ts`: its real unreferenced 250 ms timer collects a post-result row without another turn, updates `usage`, `tokens`, the budget and roll-up, and leaves `turn_end` unchanged. The A/B test fires the injected scheduler while task B is open and proves that A's delayed row keeps A's attribution, increments no turn total, and that an ambiguous timestamp is `unattributed`. These fixtures establish the #1281 behavior, not a current native delay.
+
+The earlier native delay observed on Kimi 2.3.1 remains recorded in [2026-10-25-kimi-usage-ac11.md](2026-10-25-kimi-usage-ac11.md). A future version that again produces a post-result row should repeat this receipt's ordinary-turn leg.

package/docs/verification/2026-11-07-kimi-review-watch-1284.md

@@ -0,0 +1,115 @@
+# Kimi review policy watching (#1284)
+
+Date: 2026-11-07. Task #785. These are model-free private fixtures on dgx02,
+Linux x64, Bun 1.4.2. The production Kimi preparation and reviewer peer are used
+with an owned fake print/version command and synthetic OAuth files. No real Kimi
+CLI, provider, account, credential or model interaction is claimed. COMPAT and
+machine trust are unchanged.
+
+The historical baseline was measured before production optimization, at
+`4daaa842db4035c5504caff6867445b47b7c1be5`. It drives the actual old
+`ReviewerPrintPeer` interval and complete `current()` fence. Input is exactly
+1048576 framed bytes; the generated agent file is 1048868 bytes.
+
+The post-change samples below are bound to
+`dedbf4974d2a91ebd96623f4bd4a1ca04c06ac47`. The worker mode uses the real
+policy worker and new controller. Inline-reference mode uses the same full fence
+on the main thread under the new controller; it is a comparator, not another
+measurement of the historical interval.
+
+## Measurements
+
+Values are milliseconds. Authority samples are eight synchronous `reviewToken()`
+calls. Periodic samples are three checks per mode, after preparation has already
+read the private files. These are small warm-fixture samples, not a cold-start,
+production latency regression, p99 estimate or general speedup claim.
+
+| Mode | Authority mean / max | Ordinary check mean / max | Ordinary start-to-start |
+| --- | ---: | ---: | --- |
+| Historical inline interval | 1.631 / 3.011 | 1.657 / 1.776 | 100.259, 100.214 |
+| Worker | 1.709 / 3.937 | 2.748 / 2.998 | 100.362, 99.739 |
+| New-controller inline reference | 1.613 / 3.095 | 1.725 / 1.877 | 99.857, 100.511 |
+
+The worker check includes IPC and completion overhead. Work is moved off the main
+event loop; the filesystem/hash work is not eliminated. Synchronous authority
+checks remain synchronous and retain their separate measured cost.
+
+A second phase adds a synthetic 150 ms hold, separately recorded from the actual
+full-check cost. The worker is held inside its real request path until an
+independent requester receives a real loopback control response. The fixture
+checks that the underlying check has not completed prematurely. Inline modes
+block the main thread; the independent requester confirms its request was sent.
+The control server shares the actual reviewer's process/event loop. This is a
+causal control fixture, not an installed daemon's response-time trace.
+
+| Mode | Slow start-to-start | Causal shared-counter order |
+| --- | --- | --- |
+| Historical interval | 160.648, 152.533 | check start 1, check end 2, control dispatch 3, response 5 |
+| Worker | 165.924, 154.460 | check start 1, control dispatch 2, response 3, check end 4 |
+| New-controller inline reference | 162.538, 153.221 | check start 1, check end 2, control dispatch 3, response 5 |
+
+Every sample's maximum concurrent checks is one. The first synthetic sample can
+include requester coordination in addition to the nominal hold; it is not
+reported as production hash cost. Assertions use ordering, not a host-specific
+latency threshold. A fake monotonic clock separately proves that a check started
+at 100 and completed at 350 schedules an immediate overdue check at 350, then a
+fast completion schedules 400, without replaying every missed tick.
+
+The full numeric baseline output is retained in the workspace's
+`scratchpad/temp/task785-baseline-4daaa842.log`; the benchmark command emits the
+raw arrays, ordering counters and cleanup flags. The post-change command is
+`bun scripts/benchmarks/kimi-review-watch-1284.ts`, with `--inline-reference`
+selecting its comparator. Each observed run confirmed peer stop, requester join,
+profile removal and unchanged synthetic source files; post-change runs also
+confirmed policy-worker join.
+
+## Validation and ownership
+
+Both synchronous authority checks and the worker call the same complete
+filesystem checker: lexical and physical cwd ancestors, native source identity,
+executable metadata, source configuration hash, all three private-file hashes and
+all native/private auth targets. The parent adds abort/cleanup guards before and
+after an asynchronous check. No successful asynchronous result is cached as
+verdict or task-MCP authority. Version probing, fresh private homes, the two-tool
+allowlist and OAuth-lock teardown are unchanged.
+
+The worker receives a closed immutable projection of expected paths, metadata
+and fingerprints, not serialized task facts, configuration contents or inherited
+environment. It still reads the bounded files to hash them. Requests are
+serialized and replies carry only a monotonic request ID and boolean. Error,
+output, protocol and early boot failures poison the probe, including before the
+first periodic tick; error text is not forwarded.
+
+Each child/review sequence owns its watcher. Stop cancels scheduling before
+joining a blocked check, initiates worker termination even if native stop fails,
+and joins before profile deletion or confirmed input cleanup. Failed joins keep
+the owner/profile and busy state until an explicit stop retry. A late result
+cannot settle or revive a subsequent review, even for the same task and batch.
+Worker progress never touches the native inactivity watchdog.
+
+The source worker has a JS wrapper. The plugin has a separately generated,
+self-contained sidecar with the same basename. A fixture copies that sidecar
+alone into a directory containing a space and executes it without a source tree
+beside it. Both generated assets use the pinned Bun after a worktree-local frozen
+install; neither is hand edited.
+
+At `dedbf4974d2a91ebd96623f4bd4a1ca04c06ac47`, dgx02 typecheck and 75 tests
+across six files passed (514 assertions), followed by both numeric benchmark
+modes. Coverage includes actual workers, empty environment, closed projection,
+cwd/binary/config/auth changes, equal-size restored-mtime content tampering,
+atomic OAuth refresh, stop while blocked, cleanup retries, early failure,
+same-task late results, watchdog and output-limit cleanup. Existing Kimi isolation,
+privacy, two-tool and lifecycle assertions were retained. The one old fake launch
+with `watchCurrent` gained the asynchronous probe required by the new contract.
+
+Two earlier fixture failures are not passing evidence: `28b7a07c` stopped at a
+missing MCP-schema `additionalProperties:false`; `f5b5e8e2` passed typecheck and
+56 tests but four new mtime cases used sub-ms timestamps that `Date` could not
+restore exactly. The corrected fixture initializes exact whole-second timestamps
+before binding; its size, precision and refusal assertions are unchanged.
+
+Final canonical/seed/hosted-CI results are recorded at their exact tested heads
+in the PR/task. Inventory discovery was deferred once with exit 75 because three
+remote slots were occupied; no retry loop or local test/index fallback ran. No
+documentation stamp, native version receipt, model-quality claim, merge or tag
+is part of this change.

package/docs/verification/2026-11-08-agy-1.5.3.md

@@ -0,0 +1,96 @@
+# Antigravity 1.5.3 account-free compatibility receipt
+
+Date: 2026-11-08. Task #801, Refs #843. Repeats the [1.4.12 account-free procedure](2026-11-03-agy-1.4.12.md) and its [actual-launcher nonce leg](2026-11-03-agy-1.4.12-launcher-nonce.md).
+
+**Decision: add exact 1.5.3 to verified.** All four required account-free legs passed on the same installed executable. The accepted 1.4.x line is unchanged; 1.5.2, 1.5.4 and other 1.5.x versions remain refused without person trust. This is compatibility evidence, not an account/model, permission-mode or headless ACP qualification.
+
+## Exact executable and isolation
+
+- Host macOS 27.0.1 arm64, pinned Bun 1.4.2. Native `--version`: 1.5.3. Installed executable SHA-256 `5e4b545bff4a83a93354fc50c54631cf3e8cd02e1a469087af00929f3fdc4d51`, 208,900,592 bytes. No CLI install, update or downgrade was performed.
+- CLI surface used source `4b0d36639d9417b7a810175ed3c9a13d49f429c6`; hooks and actual launcher used `01b87a7cafb35e69403d9500c4136909c3741089` (a receipt-only commit; runtime and committed bundle unchanged). The native evidence precedes the mechanical verified-set change. Frozen dependencies matched agent-mem 0.22.1 and SDK 1.30.0.
+- Fresh 0700 controller roots were outside the actual home. HOME, XDG config/cache/data/state, AGENTHUB_HOME, AMEM_HOME, project, state and TMPDIR were set before hub imports. No real credentials/settings or parent agent/session/Orca markers were copied. Later controllers also started Bun from that fresh root with --no-install; the earlier worktree had no dotenv files.
+- Every agy invocation, including help/version/mcp probes and launcher preflight, used `AGY_CLI_DISABLE_AUTO_UPDATE=1` and Seatbelt. The profile reuses `src/local/sandbox.ts`, then denies typed and canonical actual-home reads/writes. Only exact agy/Bun executables, required code and private fixture paths are allowed; native egress is only the fixture provider and, for the launcher, its own control port. Port 4600 is never used.
+- Positive controls: `/usr/bin/true` and the pinned Bun helper succeed. Opening a named real Gemini config for reading and opening the installed binary with O_WRONLY, without truncation or writes, both fail with Operation not permitted. The provider connection succeeds; a second owned loopback port is denied. These are probe controls, not a claim of ordinary agy confinement.
+- The controller compares the five named real config entries, the binary hash and its directory inventory before and after. Every completed native run matched. It joins owned teardown and checks captured process identities plus private-path survivors; it never signals unknown processes. Observed cleanup is not proof against arbitrary detached helpers.
+
+## CLI surface: passed
+
+| Probe | Result |
+| --- | --- |
+| --version | 1.5.3, exit 0 |
+| --help and help | Exit 0; --continue, --conversation, --disable-slash-commands, --input-format, --output-format, --print, --prompt-interactive, --project, --remote-control and --sandbox remain present |
+| --acp and --new | Exit 2 with the expected unknown-flag diagnostic |
+| Subcommands | All twelve historical subcommands remain; acp is also present |
+| mcp list in the empty isolated project | Exit 0, No MCP servers configured |
+
+Help is on stderr (3,319 bytes), so the final collector checks both streams. An earlier collector measured stdout alone and did not prove flag presence. CLI log: private scratch `temp/task801-cli-153-streams.log`.
+
+## Synthetic plugin MCP and hooks: passed
+
+The installed native print transport used -p, --output-format stream-json and --disable-slash-commands against a loopback Gemini fixture. Synthetic hub_task_show and hub_review responses are stand-ins, never actual board reads or approvals.
+
+- Four authenticated provider requests; all fifteen declaration names match the previous receipt. Native init has 60 tools and permission_mode request-review.
+- MCP discovery, initialize, initialized and tools/list occur in order. Exactly two calls carry the expected object arguments: hub_task_show id 1; hub_review id 1, verdict approved, fixture-only note. Native call_mcp_tool retains ServerName, ToolName and Arguments, without toolSummary/toolAction.
+- Native read_file has Path, StartLine and EndLine and reads only the canary. Its result appears in the next fixture request.
+- Six phases: SessionStart, PreInvocation, PreToolUse, PostToolUse, PostInvocation, Stop; sixteen hook rows. Shared fields, invocation counters and toolCall fields match the previous procedure. Both injectSteps markers reach the later fixture request.
+- Stop is NO_TOOL_CALL, executionNum 0, fullyIdle true, empty error. Print exits 0, no stderr or signal fallback. Profile, loopback and helper controls pass.
+
+Two initial producer checks failed, and remain recorded as failed attempts. The diagnostic kept their assertions unchanged: the fixture itself sent Arguments as a JSON string, and the collector looked for system/subtype init instead of the native top-level init object. The corrected fixture sends an object, as the historical actual-hub nonce producer already did, and reads the unique init object. Exact raw arguments and request-review remain asserted. This does not claim a historical native transport difference.
+
+Final hooks log: `temp/task801-hooks-153-object.log`; producer SHA-256 `8e60b161f01e1ec06063c56a5ab710135624f0deb2cf65297baa54c4c418c2e2`; runtime SHA-256 `6a31b50060e38e5f9bc8176f086a7ad743ec9e8b0e3d58f0182ad51116ed5cc4`.
+
+## Actual launcher nonce and normal TUI close: passed
+
+One actual `ahub --live-test --project <private project> agy` session proves both legs. Native UI used a private foreground tmux 3.8 server with an explicit fresh socket and -f /dev/null; no existing tmux session, Orca window or personal profile was used. A fixed Bun-only stdin/EOF helper passed before any agent launch.
+
+The stock gate still refused 1.5.3 during the probe. The controller used typed writeTrust only at an explicit fresh AGENTHUB_HOME/agent-compat.json, verified as a 0600 owned regular file with one exact 1.5.3 entry. Actual version assessment was trusted, not verified. This fixture waiver enabled a candidate test; it did not qualify the version or modify machine trust.
+
+The scratch Registry claim used its own PID/signature, project and instance. Daemon memory/native capture/sync, inference, triage, research, specs, snapshots, schedules, gateway URLs, MLX and Pi auto-start were off. Parent fetch was limited to the two owned loopback ports; native had the Seatbelt fence above. Provider requests require the synthetic fixture-key, refuse Origin and are body/count bounded. No real account or cloud model was used.
+
+| Observation | Final result |
+| --- | --- |
+| Managed plugin during TUI | hooks.json, mcp_config.json, plugin.json, bound to this instance/launch by actual agyMcpReady |
+| Fixture privacy checkbox | unchecked observed before continuing; folder trust applies only to the private fixture |
+| Provider requests and declarations | 4; declaration counts 0, 12, 15, 15 |
+| Actual MCP read | one call_mcp_tool for agent-hub_agent-hub/hub_inbox |
+| Nonce provenance | RAM-only producer value placed only in the scratch bus preface, never argv, env, prompts or receipt; nonceAfterInbox: true in a later provider request |
+| Peer identity | canonical agy only, no agy shadow session |
+| Normal close | /exit and Enter; normalExit: true, native/launcher exit 0, resume command observed, no native signal fallback |
+| Cleanup | all three managed files removed, bystander plugin/rule hashes unchanged, peer offline; a new begin/end control pair proves slot release, not a second TUI launch |
+| Processes and handles | interactive tree, daemon, provider, Registry claim and Registry closed; controller removed its private root; final owned-process inventory clear |
+| Real config/binary | five named entries and binary/directory inventory unchanged |
+
+The parent-JS external/unrelated fetch-attempt counters were zero. This is not a count of every native network attempt; native egress is constrained by Seatbelt. CLI/print command bound is 25 seconds; TUI total is 80 seconds with one 45-second normal-close window.
+
+Prototype launcher attempts stopped at setup barriers, used owned fallback cleanup and are not normal-close passes. An ANSI byte-window collector could not reconstruct checkbox partial repaints; the final collector reads tmux's current screen. The first tmux run also waited for daemon idle before MCP lazy attachment, preventing the second prompt; the corrected producer uses the actual TUI input screen there. It still requires actual nonce readback, canonical identity, normal close and cleanup. No native/product permission or timeout was relaxed. An initial lexical /var versus canonical /private/var fixture mismatch was fixed in the controller; its unconfirmed first failure stage is not native evidence.
+
+Final launcher log: `temp/task801-launcher-153-lazy.log`. Its source/bundle/private producer fingerprints follow; original historical producers were rehashed unchanged.
+
+- Bundle SHA-256: `333975a6aeec1413cf5ae30d6bb292c7318362f795230db8e0d5133b7d144d1e`.
+- interactive-bridge.ts SHA-256: `d87cb1db044cf1c036f7a41b06bf3023ab8d0b81e957e0302b154d54656d8348`.
+- interactive-session.ts SHA-256: `f8a06759abead1629998593d57c0cfac69f5d488e44a0d88b549fe0d9a92febc`.
+- tmux-session.ts SHA-256: `6b2f6f9216a3e2f2c3a6d4c5950b7bfe24a7162d0a331356b855ce04287253e0`.
+- tmux-helper-control.ts SHA-256: `a13c7a4b1702be7f667857eee0fd9f805c16441fd0f0b9e44ce1b7d962c76373`.
+- launcher-nonce.ts SHA-256: `55ff4db3462ad185dde17cc31ef971422e022f5ec8ce2940e4045501964c1ac1`.
+- runtime.ts SHA-256: `6a31b50060e38e5f9bc8176f086a7ad743ec9e8b0e3d58f0182ad51116ed5cc4`.
+- run-probe.py SHA-256: `16c6f4b1026250685097089f31c4b2d450d91589fa78dfa6c5f9b5c260efb5e5`.
+
+## Named real Gemini config inventory
+
+Only these five entries were hashed; contents are not published.
+
+| Relative entry | Before and after SHA-256 or absence |
+| --- | --- |
+| `antigravity-cli/settings.json` | `ad07119c21cf14ea153eb4200d6468add57d4e26783808f384f4bf7d4df31682` |
+| `config/config.json` | `b8c51361bf83a00ae5e38b3108b48ffa3b4cfc7c4e9d9b7d16e04f74725f3c14` |
+| `config/mcp_config.json` | `d8e397af03b5b032f21d0aa967086f0c78b33c87b76f2e9898ae0a144df7de02` |
+| `config/import_manifest.json` | Absent |
+| `settings.json` | `66c879018049d90632634790fe0b0eae54616a144e594c5db1b40b7c8be8c7b9` |
+
+## Reused evidence and limits
+
+The [exact reviewed 1.5.3 ACP T0 record](https://github.com/STAIxBWLB/agent-hub/blob/1e6da1ee221acd601fa28201c8cd0081d8214566/docs/verification/2026-11-08-agy-acp-t0.md) covers account-free initialize. Its isolated session/new returned Authentication required. Its other run used an existing personal login and is not reused as account-free qualification. Neither run substitutes for the native legs above.
+
+No real account, real model tool choice, native permission-mode mapping, headless ACP prompt/cancel, IDE or Linux behavior is qualified. The native probe's Seatbelt does not add a hub sandbox to ordinary agy. Fresh reviewer MCP and agy's implementer/verifier role ceiling are unchanged. The harness manifest keeps its historical procedure and autoAdmit false; no workflow, global trust or verified stamp is changed.
+
+The source PR adds only exact 1.5.3, updates receipt/trustNote and keeps the 1.4.x line. Canonical DGX and hosted CI results belong to their exact committed heads and are reported separately in the PR/task submission. No release or live upgrade is claimed.

package/docs/verification/2026-11-08-agy-acp-t0.md

@@ -0,0 +1,56 @@
+# agy acp T0 capability probe (agy 1.5.3)
+
+Refs #1280 (P2), #485. Model-free: `initialize` and `session/new` only, no prompt, no credential read. Run with `AGY_CLI_DISABLE_AUTO_UPDATE=1`.
+
+Two runs: run 1 under the person's real home (a mistake against the planner ruling, cleaned up below) and run 2 under a disposable HOME (the isolated run of record).
+
+## Run 1 (person's home, cleaned up)
+
+The person's existing login was in scope, so `session/new` succeeded and created session state. Exactly these files were created by the probe and removed; nothing else in that home was touched:
+
+- `~/.gemini/antigravity-cli/conversations/<sessionId>.db`
+- `~/.gemini/antigravity-cli/brain/<sessionId>/` (empty `scratch/` and `.user_uploaded/`)
+- `~/.gemini/antigravity-cli/log/acp-server-20261108_000903-24787.log` and `acp-server-20261108_000951-32157.log`
+
+An `implicit/*.pb` file with a nearby mtime is not referenced by the probe's log and was left alone.
+
+## Method
+
+- `agy --version` prints `1.5.3`.
+- `agy acp` on stdio, newline-delimited JSON-RPC 2.0.
+- Request 1: `initialize` with `protocolVersion: 1` and empty `clientCapabilities`.
+- Request 2: `session/new` with `cwd` set to a scratch directory and `mcpServers: []`.
+
+## Run 2 (isolated HOME, the run of record)
+
+`HOME` and `XDG_CONFIG_HOME` pointed at a fresh temp directory, no account. `initialize` answered exactly as in run 1 (same capabilities and `authMethods`). `session/new` was refused: `{"code":-32000,"message":"Authentication required"}`. The process wrote only under the temp home (`.gemini/config`, `.gemini/antigravity-cli`: state, installation id, one `acp-server` log, builtin plugins); the directory was removed afterwards.
+
+Finding: `initialize` needs no login; `session/new` and everything after it need one of the four `authMethods`, so a hub-owned headless `agy acp` needs a person-provided login or API key and cannot be probed beyond `initialize` without one.
+
+## Observed in run 1 (person's home)
+
+- `initialize` result: `protocolVersion: 1`, `agentInfo` `Antigravity ACP Server` `1.5.3`.
+  - `agentCapabilities.loadSession: true`.
+  - `promptCapabilities`: image true, audio false, embeddedContext true.
+  - `sessionCapabilities`: `resume`, `close`, `load`, `list`, `additionalDirectories`.
+  - `_meta.antigravity`: `tier`, `systemPrompt.append`.
+  - `authMethods`: `oauth-personal`, `oauth-business`, `gemini-api-key`, `agent-platform`.
+- `session/new` result with the person's existing login: a `sessionId`, `models` (13 ids, `currentModelId` `gemini-4-argon-medium`), `modes` (`default`, `accept-edits`, `plan`; current `default`), and `configOptions` `model`, `thought_level`, `mode`.
+
+## Maps onto the hub's ACP surface
+
+- Native modes `default`, `accept-edits`, `plan` map one to one to the hub's `ask`, `accept-edits` and `plan` permission modes.
+- `session/resume`, `session/load` and `session/close` exist, so the hub's restore path (`restoreArgs`) can resume an agy session by id.
+- `additionalDirectories` gives the hub a way to scope extra roots without a TUI flag.
+- `models` and `thought_level` are selectable through `configOptions`, so `launch.model` can be passed through.
+
+## Not proven here (blockers for wiring `AcpPeer`)
+
+- No prompt was sent, so these are unverified: `session/prompt` streaming shape and `stopReason` values, `session/cancel`, mid-turn steering, `session/request_permission` payloads and their option ids, and `usage_update` or token fields.
+- Whether `agy acp` honours the managed hooks (`hooks.json`) or a separate approval path; the TUI hook floor (#1280 P1) may not apply to ACP turns.
+- Whether `mcpServers` passed to `session/new` load the hub MCP server for a headless peer.
+- Authentication of a hub-owned process: run 2 shows it is required; how the hub would supply it without reading a credential is open.
+
+## Decision
+
+Probe receipt recorded; `AcpPeer` wiring for `agy` stays out of this change. Wiring needs one authorized model-backed turn to prove the prompt, permission and cancel legs, which the person must approve (it spends quota). Follow-up: a task for the model-backed receipt, then the `ahub agy --mode headless` and `ahub watch agy` wiring.

package/docs/verification/2026-11-08-hub-visual-1058.md

@@ -0,0 +1,161 @@
+# Hub visuals evidence, #1058
+
+This records task #709 evidence by exact head. The published 0.1.7 fixture and isolated browser legs passed below; the final canonical gate and hosted CI are recorded separately. Live observations were recorded by Codex and do not turn synthetic guard coverage into native all-peer qualification.
+
+## Checks by head
+
+- `cc7b89c3f664dc08b5f9c2563ea258de22a68bc5`: DGX typecheck and focused tests passed, 177 tests, 0 failures, 2,601 assertions across 11 files. Evidence: scratchpad `temp/task709-focused-cc7b89c3f664dc08b5f9c2563ea258de22a68bc5.log`. This is focused evidence, not the canonical changed gate at the final head.
+- `2bbd9b67b3b70b6f67cfed2f4476d288ab73af33`: bundle built using pinned Bun 1.4.2 and a frozen install. Generated bundle SHA256: `64e96449215a395efa8c9b99bcf525ce7eced256764705223c065aaba5d017c3`. Source provider SHA256: `ea41d5aeb7f871e3fe856d5bfabfb4c869966e6dfa75006baad40f047e171989`.
+- `cfeb1d2913bb`: the first canonical DGX changed gate selected the full suite: 12,709 pass, 101 skip, 5 fail across 986 files (12,815 tests; 318,515 assertions), exit 1 in 2,205 seconds. Typecheck, inventory, bundle freshness and package checks passed. Failures were the read-only MCP tool inventory, two registry guard assertions on a config object literal, task detail section expectations and an extracted role-visibility fixture missing its new UI dependency. Corrections preserve existing assertions; this is not a green gate. No current-invocation daemon leaks were found.
+- `f823646789b5e6f3022cfb38b6c617c9a89862e7`: correction-focused DGX typecheck plus 84 pass, 0 fail, 652 assertions in six files. Its subsequent full run was intentionally interrupted via the owned remote_dev SIGINT cleanup after the independent recovery finding made that head obsolete (exit 130 after 1,568 s). It is not a green full gate or a resource deferral.
+- `d4b52acb59a2f8f6922bf2ed47778cbf21ba00f2`: held-recovery retention correction, DGX typecheck and 20 pass, 0 fail, 182 assertions in two files. The new fixture retains an expired-on-target row unchanged while held, releases with matching digest, then confirms normal pruning after release.
+- An inventory-only DGX command at `2bbd9b67` stopped before checking classifications because its disposable tree had no frozen dependency install (`ts.ScriptTarget` unavailable). The canonical gate performs that install first. Final inventory and canonical committed-head validation are pending; no canonical pass is claimed here.
+
+## Actual acon observation
+
+Two isolated runs used real acon 0.1.3, the source provider and production daemon with a synthetic peer, six visuals per run. The final run is bound to `2bbd9b67b3b70b6f67cfed2f4476d288ab73af33`; its body-free counts, hashes and cleanup are in scratchpad `temp/task709-live-2bbd9b67-e.log`. Codex viewed `temp/task709-acon-render-e.png`.
+
+- Comparison `<b>` and table `<i>` text remained inert.
+- Two valid 74-byte, 2 by 2 PNG assets returned HTTP 200 and matched their expected hashes. Before SHA256: `1fe7e0db6305cd87580a13d22dde4e6fa6efea01abab2de43f0d23fdde4e9e26`; after SHA256: `500f9b69351abec04ae9956400cc6406f640b596a4ada1e2e1a58e15d6ae4845`.
+- Replacing the after PNG caused HTTP 502 with a safe System cause and next step; changed bytes were not served.
+- Malformed Mermaid showed a notice and source fallback. Valid Mermaid reached the five-second fallback. Successful SVG rendering was unverified in these historical 0.1.3 runs.
+- The final log records six posted visuals, two fixture PNGs, one mutation and zero external fetch attempts. Its `sharedCases: 4` counter counts the four candidate cases exercised; it is not evidence of a published shared fixture. Codex operated the browser, checked the actual DOM and viewed the screenshot; `browserAssertions: 0` is the temporary harness counter, which does not count those separate browser checks.
+- Own provider, console server, tools, console, synthetic peer, daemon, registry, handles and external browser were closed; the process exited without forced stop and its scratch root was removed. Owned sockets were closed.
+
+No account, native agent or model was used. No standalone hub UI browser was used. Initial a/b/c preflights failed at the scratch routing MLX guard before listeners were opened; no production guard or bound was changed to make them pass.
+
+## Boundaries and remaining evidence
+
+- Validation rejects malformed or oversized payloads, screens text and preserves cleared extra table row keys. Tool paths and stored asset references have distinct shapes. Fake source-guard coverage is not a live privacy or native-role receipt.
+- Assets remain bound to guarded file identity, hashes and current privacy authority on reads. The changed-PNG observation covers one actual asset mutation path.
+- Unbound visuals expire after the configured retention period (default 30 days); task-bound records remain unless task existence proves them orphaned. Recovery inventory hashes stored metadata and payload/file-reference JSON, not image bytes. Focused fixtures cover corruption refusal, cursor cleanup, retention and archived reset separation.
+- Historical 0.1.3 observations did not qualify WebP: that host and 0.1.4 refused its MIME type. The published 0.1.7 follow-up is recorded separately below.
+- Historical fixtures were hub-owned candidates with source provenance. They did not fill the shared-fixture gap; the 0.1.7 follow-up imports the published cases directly.
+- The ordinary peer transports were covered by source/fake checks, not native all-peer journeys. Such native journeys are not an additional acceptance requirement in the issue. Fresh-reviewer MCP intentionally remains exactly hub_review and hub_task_show under D2. Mermaid SVG success was unverified in the historical 0.1.3 run; the 0.1.7 observation below records successful rendering. D4 still explicitly permits a five-second source fallback.
+
+The earlier planner ruling recorded AC1 unmet after the agent-console#78 handoff refusal, and AC4 unmet while agent-console#81 had no published support. Those were not waived. Published support and the 0.1.7 follow-up results are recorded below. Successful Mermaid SVG was unverified in the historical 0.1.3 evidence and is verified by the isolated 0.1.7 observation; standalone browser rendering remains unverified. D4 permits source fallback.
+
+Completed overlap work was checked: main contains Kimi delayed usage (#783), AGY count-only hints and person attribution. Their imports, immutable turn attribution and shutdown cancellation are preserved; none replaces visual authority or generation checks. Open #800 ownerAttachment stays display-only, and #802 rememberOutcome remains separate from visual capture. The current main merge includes only already-merged work; no peer branch is imported. Final committed-head canonical validation is separate and remains pending until its result is recorded.
+
+## Published dependency follow-up
+
+Primary recheck on 2026-11-08 found agent-console#78 and #81 completed and npm 0.1.7 published. The exact devDependency and lock now adopt 0.1.7. The upstream VISUAL_CASES module is imported directly, never copied: 42 cases, with six fixed, documented valid-acon/stricter-hub cap differences. Missing alt still refuses and now names the precise alt field. Old candidate provenance remains historical 0.1.3 with a separate 0.1.7 recheck; it is not labelled canonical. Type-only production imports preserve the dependency boundary.
+
+Earlier AC1/WebP unmet observations above describe the 0.1.3 evidence. They are superseded by the following direct fixture and browser observations, not solely by an upstream issue state or package version.
+
+- Frozen source head `afc1e459447a779a2418457640b80fda5c0eafb3`: DGX frozen install, typecheck and focused checks passed, 142 tests, 0 failures, 630 assertions across seven files, exit 0 in 37 s. Log: scratchpad `temp/task709-017-focused.log`. The canonical test imports all 42 published cases and checks six explicitly named stricter hub-cap differences.
+- Real acon 0.1.7 loaded the actual source provider and production daemon in an isolated HOME/project, with a synthetic ordinary peer and no account, native agent, gateway, memory sync or model. It posted seven visuals, including four normal cases selected from the actual published module, two software PNGs and one software WebP. Published case module SHA256: `68455a97595664d88fc62567a301ef5e5e06abf78b75145f528a38b5c5bf39b6`.
+- Both PNGs returned HTTP 200, `image/png`, inline disposition and the same 74-byte hashes recorded above. The 38-byte WebP returned HTTP 200, `image/webp`, inline disposition and SHA256 `ea6a0dfbc1103e231f69d8a08182ac8168f9aa06242f1d1606a9e82894a45e40`. All six displayed image elements decoded to 2 by 2 pixels after scrolling into view. The browser's lazy loading was respected, not disabled.
+- The normal flow rendered A -> B in the sandboxed frame. The malformed flow showed "The diagram could not be drawn, so it is shown as text" with its original source. Codex viewed screenshots `temp/task709-acon-017-flow.png`, `temp/task709-acon-017-webp.png` and `temp/task709-acon-017-fallback.png`. The 2-pixel fixtures establish decoding, not useful image-layout quality.
+- Replacing the after PNG returned HTTP 502 and the safe System cause/next step "visual asset changed since posted or no longer allowed; post the visual again using a current public file". No changed bytes were served.
+- One scratch HTTP URL builder encoded the plugin reference's @ and therefore received 404; the actual console-generated route was correct. Direct HTTP readback used that route spelling. No production URL or provider code was changed to make the check pass. An initial generic CSS scroll matched an earlier figure; selecting the actual last figure exposed the expected deferred renderer and fallback. Neither observation is counted as a product failure or silently omitted.
+- Body-free log `temp/task709-live-017-f.log` records seven posts, four published cases, two PNG fixtures, one WebP, one mutation and zero external fetch attempts. `browserAssertions: 0` remains the harness's counter; separate browser DOM/readback and viewed screenshots supply the browser evidence. It records provider/server/control clients/synthetic peer/daemon/registry/handles closed, owned process exited without forced stop, browser closed and scratch root removed. The separate owned browser socket directory had no open handles and was removed.
+
+These observations complete the previously missing shared-fixture and WebP legs. The standalone dashboard remains covered by extracted UI/fake-host checks rather than a browser run, and native all-peer journeys remain unrun. The final canonical committed-head result and exact-head hosted CI are still pending here; no full green gate is inferred from the focused or browser checks.
+
+
+## Final review corrections and pending gate
+
+Independent preflight found and verified fixes for held-recovery retention, the old host WebP refusal, and the advertised path-side alt schema. At `47b291c696d1461fa38a9d3682389879b0af783e`, alt remains required and bounded but may be empty, matching the published case and runtime. The regression checks both accepted empty alt and refused missing alt. DGX frozen install, typecheck, inventory and 143 focused tests passed (0 failures, 633 assertions across seven files; exit 0 in 37 s). Inventory was OK: 3,534 entries, 2,529 classified, unchanged 1,005-entry baseline. Log: scratchpad `temp/task709-alt-focused.log`. The pinned Bun bundle was regenerated.
+
+The canonical run at `1ee364c3dc9c473cb3e8fa12c974e72740dc13a6` was stopped via the verified owned remote_dev helper's normal SIGINT cleanup after that schema finding made its source obsolete (exit 130 in 62 s). No pass or resource deferral is claimed. The final report head starts one fresh canonical `scripts/check.sh --changed` run; its result is not yet available here. Exact-head hosted CI remains a merge gate.
+
+A separate O3 full gate at `45b5dca1` exposed a pre-existing main fixture assumption in `test/herdr-companion-platforms.test.ts:85`: it expects `/home/dev` not to exist, but that is the DGX container HOME. That fixture is unchanged in this branch. It is reported to the conductor rather than edited in this visual feature. A failure from that assertion must not be presented as a green canonical gate.
+
+
+## Review correction: metadata snapshots and refusal classes
+
+The review at `687d579f` found two Important defects: operational refusal causes
+were collapsed into a privacy message, and periodic snapshots re-read and
+re-screened up to twenty full payloads. This revision separates operational
+recovery, role, membership, observer, shutdown, authority, storage, concurrent
+change, screen-unavailable and policy-unavailable diagnostics. Sensitive privacy
+hits retain uniform wording. An unknown or throwing screen still fails closed;
+its error body is never returned.
+
+Snapshots use the store's metadata projection plus bounded file-path metadata,
+never `get` or `payload_json`. Relevant raw policy bytes and accepted path arrays
+key a narrow policy projection; no full `loadConfig` runs on this path. Current
+accepted restrictions remain unioned with the normally merged candidate path
+rules, and each read still checks exposed title/from/task/path metadata. Explicit
+show rechecks the complete payload. Missing files keep their public explanation;
+the guarded asset read alone decides current existence and hash.
+
+The same revision makes all three prune sites wait for both recovery holds,
+uses a nonmutating `Limiter.peek` before expensive validation/screening/reads and
+retains one final consuming admission, admits explicit `to: "user"`, and removes
+visual-only calls from task-progress evidence. Three moved limiter inventory
+keys keep their original labels; the baseline is unchanged.
+
+Structural tests cover twenty tiny and maximal-table rows, forbid full payload
+reads, use corrupt/oversize body canaries, preserve metadata privacy, and assert
+peek's bucket/repeat/group state never changes. Cause tests use real daemon
+operations for reachable states and a real tools request under prepared recovery.
+Stopping and stale child-authority branches execute the actual extracted closure
+with all later ports forbidden; these are unit evidence, not native-child
+qualification. New exact-head test results follow when available.
+
+The obsolete canonical run at `687d579f` was stopped through its verified owned
+remote_dev helper's normal SIGINT cleanup after this review (exit 130 in 701 s),
+not counted as a pass or deferral. No duplicate run was started.
+
+
+The first review-correction run at `0df8749a61accff31bdbce806f9c95d73d68f37e`
+passed typecheck and inventory, then had 247 pass and 3 fail (1,351 assertions,
+ten files; exit 1 in 45 s). New fixture assumptions caused the three failures:
+an initially off-roster peer is refused at hello before its tool call; closing
+the journal also activates a recovery hold; and `settings_reload` returning
+`ok: true` can be an unconfirmed preview, not adoption. The corrections preserve
+cause/next-step and zero-effect assertions, and confirm configuration adoption
+before releasing the held call. This run is not a green gate. The independent
+read-only preflight found no new Important code issue in that delta; the generated
+bundle was excluded from its 14-file source/test/doc coverage.
+
+
+Subsequent focused runs preserved those assertions while correcting the roster
+fixture: `0bef303c` had 249 pass, 1 setup failure (1,367 assertions, ten files;
+46 s), `3b6dcf19` had 33 pass, 1 setup failure (291 assertions, one file; 35 s),
+and the single-case `bb93351f` run failed on the fixture's status lookup (4 s).
+The real roster API saves membership even when the passive fake cannot prove a
+native stop; its explicit unconfirmed-stop result is asserted rather than
+replaced with fabricated stop evidence. Effective settings rows, rather than a
+removed peer's status entry, confirm the saved membership.
+
+Once that setup reached the actual call, `39a75723` exposed a further product
+path: the outer WebSocket membership guard returned only "codex is off roster"
+before the visual handler, so the next-step assertion correctly failed (one
+case, 4 s). The outer stopping and prepared-recovery guards were also traced.
+Visual requests now receive the same operational guidance at those boundaries,
+without changing any admission condition or non-visual response. Assertions were
+not weakened to accept the incomplete message. Full native-child stop/identity
+qualification remains outside these passive and extracted-unit fixtures.
+
+
+At `1388cbaa06f0682124b3e8f6a3824259985a5c42`, DGX frozen install,
+typecheck, inventory and all 253 affected tests passed: 0 failures, 1,395
+assertions across ten files, exit 0 in 45 s. Log: scratchpad
+`temp/task709-revision-check.log`. This includes the actual off-roster request,
+prepared recovery requests, outer stopping branches, metadata-only large-table
+checks, missing-image behavior, limiter nonmutation and existing configured MCP
+read-only tests. Earlier failing fixture/setup runs are retained above rather
+than represented as passing.
+
+The rewritten outer roster message is also an exact seeded anchor. Its
+`roster-request-fence` search/replacement now matches the new line while retaining
+the same false-membership mutant and original named test. The affected seed is
+in shard 29/64; that shard and all-anchor readback are checked separately before
+submission. No claim about the entire 559-seed gate is made by a focused shard.
+
+
+At `7893068fa88e4ae536311141e48c7fa38c782439`, all 559 anchors matched
+exactly once. The affected shard 29/64 passed all nine original-green /
+named-mutant-detected pairs, including `roster-request-fence`, in 24 s.
+Log: scratchpad `temp/task709-seeds-29.log`. The mutant still replaces only the
+membership predicate with false; its original named test is unchanged. This is
+a focused seeded shard, not a claim that all 559 mutants ran.
+
+The final report-only head has the same runtime and test bytes as these passing
+heads. A fresh canonical `scripts/check.sh --changed` run starts at that final
+head; its result and hosted full CI are not yet observed. AC6 remains a merge
+gate. No timeout, retry, assertion, privacy fence or baseline was relaxed, and
+no real profile, release or deployed hub was changed.

package/docs/verification/2026-11-08-jcode-0991-model-setter-1317.md

@@ -0,0 +1,143 @@
+# Jcode 0.99.1 headless ACP model setter
+
+Date: 2026-11-08. Task #809, Refs #1317 AC4. **Passed:** native setter APIs and
+the actual owned `JcodePeer`/DB-latch path in a fixture with no TUI client.
+This does not qualify a shared native TUI binding or failover concurrency.
+The production Jcode capability remains disabled pending that form restriction.
+This is compatibility evidence, not a security attestation or account/model run.
+
+## Exact artifact and setup
+
+- macOS arm64 installed Jcode reports 0.99.1, v0.99.1 (7206efd0c).
+  Its 142,887,552-byte executable has SHA-256
+  `eccb33c08a21764317b0e0bf217e60c745b90f51c7bf6d2ff90b548b9fe7383e`.
+  A single byte-identical private executable copy is checked before/after;
+  no dependency tree or personal native home is copied.
+- Native `jcodeCommand`, owned-group helpers, `JcodePeer`, `ModelOverrides` and
+  `ModelOverrideLatches` are the actual first-party implementations. The passing
+  adapter/latch source is `7c86077e89f790af0fd444b8ca9bd90e8d0bc09f`.
+- Fresh 0700 temporary roots hold HOME, JCODE_HOME, cwd, TMPDIR, all XDG and
+  hub/tool homes. Empty native/project MCP files, `JCODE_DISABLE_CLAUDE_MCP=1`,
+  `JCODE_NO_TELEMETRY=1`, `--no-update` and `--no-selfdev` avoid account/import/
+  updater paths. No configured account, key or actual model is used.
+  Telemetry-file absence is not claimed; all native writes remain isolated.
+- A native `provider add` creates one no-key OpenAI-compatible fixture profile,
+  default model `receipt-model-a`, pointing only to an owned ephemeral loopback
+  server. The integration fixture additionally declares `receipt-model-b` in
+  that same private profile's models array before startup. Endpoint, auth and
+  default A do not change. This matters: without catalog opt-in or explicit B,
+  the native default advertises static A only, even though its raw setter can
+  accept B. The probe never pretends that an unused GET model list was consumed.
+
+## Native isolation controls
+
+Every native command uses Seatbelt from the existing local-worker profile plus
+owned paths. Actual-home data and installed-runtime write-open are denied.
+Native TCP is limited to the exact fixture provider port; an owned decoy port
+is denied. Only the owned server/debug Unix sockets are allowed. No port 4600,
+actual gateway, public provider, real key or native account is used.
+
+The Rust HTTP runtime needs the named
+`com.apple.SystemConfiguration.configd` lookup. A separate create/release control
+returns a NULL dynamic-store handle without it and a valid handle with it,
+without querying or changing configuration values. The final profile adds only
+that service; file and network negative controls still pass. No OS/security
+setting, file limit or deadline is changed.
+
+The provider rejects Origin, credentials, unknown paths, oversized bodies,
+unexpected models and excess completion calls. It emits bounded fixed text SSE,
+never tool calls. Client filesystem/terminal capabilities are false. Owned
+processes and groups are stopped and observed gone. Detached lifetime
+containment is still unproven, not a disposable-runner attestation.
+
+## Native APIs and actual adapter behavior
+
+The raw protocol leg initializes exact `jcode` 0.99.1/protocol 1 and creates a
+session. While fixture request A is held, both `session/set_model` and
+`session/set_config_option` refuse with the native processing-a-prompt error.
+There is still only request A. After normal A completion, legacy set_model B
+acknowledges with configOptions and the same-session config update; the next
+request uses B. Standard set_config_option A then produces request A. Launch
+argv remains A on both serve and ACP, with wire sequence `[A, B, A]`.
+
+The separate integration leg uses the actual `JcodePeer` and its owned serve/ACP
+children, with the same profile and fixed launch A. A transparent observer calls
+the original request method with unchanged arguments and returns the same
+promise; it records only bounded method/model IDs, not replacement responses.
+
+1. Initial native advertisement proves baseline A and advertised B. The runtime
+   requires exact 0.99.1 identity/receipt plus existing Jcode compat admission;
+   native advertisement alone cannot grant a capability.
+2. A real DB override A enters the first deliver. The provider holds A's stream.
+   Writing desired B while busy sends no setter or second model request.
+3. A completes unchanged. The next deliver sends standard
+   `session/set_config_option`, `configId: model`, value B. Native B completes,
+   and the actual latch reports B applied. The private provider config hash is
+   unchanged immediately after B, not merely after a later restoration.
+4. Clear removes the DB intent. The next deliver sets the original baseline A,
+   the provider observes A, and latch status is A with no desired/pending value.
+5. Three prompts have accepted/completed receipts, two standard model setters
+   have exact values `[B, A]`, and the same owned serve/ACP launch is stopped.
+   Provider config remains byte-identical after stop. The actual installed
+   executable and selected actual config snapshot remain unchanged for the leg.
+
+The fixture native profile, CLI argv and synthetic responses are all declared
+before effects. No `jcode_cmd`, `-m`, provider-profile or credential configuration
+is made live by the runtime override. Actual hub CLI/dashboard authority is
+separate unit/integration evidence, not claimed as a native journey here.
+
+## Shared TUI limitation
+
+The ACP child checks its own `prompt_running`. The shared native server protects
+an ordinary stream with an Agent mutex, but deferred model mutation is not a
+logical TUI-turn fence. The pinned source's failed-attempt/failover retry path
+releases and reacquires that mutex; a queued mutation can run in between.
+[SetModel/deferred mutation](https://github.com/1jehuang/jcode/blob/v0.99.1/crates/jcode-app-core/src/server/provider_control.rs#L723),
+[streaming lock](https://github.com/1jehuang/jcode/blob/v0.99.1/crates/jcode-app-core/src/server/client_lifecycle.rs#L3925)
+and [failover boundary](https://github.com/1jehuang/jcode/blob/v0.99.1/crates/jcode-app-core/src/server/turn_failover.rs#L156)
+are source inspection, not a native failover execution receipt.
+This fixture has no TUI client and does not qualify that concurrency path.
+No TUI-bound live setter is enabled from this receipt without a separately
+reviewed form/ownership restriction. No native load-session recovery ceiling
+is relaxed; 0.99.1 still does not echo the restored session identity.
+
+## Failed attempts and real-home observations
+
+Two earlier raw attempts failed before serve readiness, with zero provider
+requests/setters, confirmed owned stop and unchanged per-leg actual config.
+The diagnostic attempt captured Rust system-configuration's NULL-object panic.
+The isolated dynamic-store control identified the precise missing named lookup;
+the final fresh raw run kept every assertion and bound and passed with it.
+Private logs from the failed attempts are retained.
+
+After the successful actual-peer run, the controller was accidentally invoked
+again before its earlier completion was checked. Exclusive native-home creation
+refused with EEXIST before any new native command. The first immutable structured
+result is preserved; the duplicate stdout redirect overwrote that stdout log,
+so the passing structured file, not the later log, is the authoritative artifact.
+No duplicate native run or config restore was performed.
+
+The selected actual Jcode/Kimi config/credential snapshot is nine entries,
+with symlinks recorded without following. The actual-peer leg matched before
+and after with digest
+`d5e53329f27db1df63c90c6f475049b8df13611d3913ec09b7589a1e6d580997`.
+Other probes observed Kimi credential drift between legs, before their native
+spawn; writer attribution is unproven. There is no task-wide immutable-state
+claim across those intervals, and no real file was restored or edited.
+
+## Evidence and remaining scope
+
+Private workspace scratch `temp/task809-jcode` holds the producers;
+`temp/task809` holds the controllers and closed case bindings/results.
+
+| Item | SHA-256 |
+| --- | --- |
+| raw Mac producer | `22259a94a7e568f9570dbfcee3e8ed85075bb72cd8031c87492f58ba4c0e00b2` |
+| actual-peer producer | `c75c04dcc374d1a8ed7cf7223693e975e481a9b104200ed1912ac5fd732ddcca` |
+| actual-peer controller | `4a801a8d5471274ef6269144a2d98c1ee7053808cba4d540229bd5ea511d793f` |
+| actual-peer structured result | `502bc53ef01e2f38462ab92387dd343788a636dfa38301753635f090930d196a` |
+
+Native TUI/failover, other platforms/providers/versions, real accounts/models
+and installed-hub rollout remain unverified. Source checks, canonical DGX and
+exact-head hosted CI are separate PR gates. No COMPAT/trust widening, verified
+stamp, release or production model change occurs in this task.