@staix/agent-hub 0.34.1 → 0.35.0

package/docs/verification/2026-11-08-kimi-252-model-setter-1317.md

@@ -0,0 +1,137 @@
+# Kimi 2.5.2 headless ACP model setter
+
+Date: 2026-11-08. Task #809, Refs #1317 AC4. **Passed:** the installed artifact's
+headless ACP setter changed A to B and restored A after clear;
+the running A turn was not changed. This is a model-free compatibility receipt,
+not a security attestation, reviewer isolation or provider/account qualification.
+
+## Artifact and admission
+
+- Installed standalone macOS arm64 CLI: 2.5.2, 182,590,912 bytes, SHA-256
+  `ae3fa721a361a2c9e9b6b3960560d1572a0bca6a8d1407e2017e6b70f80e7f97`.
+  A byte-identical private executable copy was verified before/after execution.
+  Native `--version` and ACP initialize both confirmed 2.5.2. The embedded Web UI
+  contains an older 2.5.1 string; it is not this receipt's version evidence.
+- The headless peer retains its existing native identity admission. The setter
+  additionally requires an exact receipt-backed 2.5.2 policy, the current owned
+  process/session and a valid model advertisement/baseline. No other version is
+  admitted by this receipt. `kimi-review` retains its separate COMPAT and
+  isolation gate, without this capability or a 2.5.2 verified-version change.
+- Native adapter/latch source was committed at
+  `1b67f69db720bc7d6feaedd5ca71abbfaad50e3a` for the original A/B leg, then
+  `771117140fd7a314db0e7af79623cffe7d3c04c4` for the A/B/clear/A leg after
+  merging the updated T1 base. The probe instantiates the actual
+  `AcpPeer`, `ModelOverrides` and `ModelOverrideLatches`; it does not substitute
+  protocol responses. A transparent observer records bounded method/model IDs,
+  calls the original request with unchanged arguments and returns its same
+  promise. This is not a real dashboard/CLI or full-daemon native journey.
+
+## Isolation
+
+A fresh owned 0700 fixture beneath `/private/tmp/ahub-809-...` supplies HOME,
+KIMI_CODE_HOME, TMPDIR, cwd, empty MCP and every XDG/tool home before production
+imports. The environment is an explicit allowlist, not inherited accounts,
+session markers, proxy credentials or personal settings. The two private models
+`fixture-a` and `fixture-b` reference the same synthetic managed provider and
+fixed loopback Anthropic endpoint. Synthetic file-backed OAuth data supplies
+only `synthetic-access-only`; the installed transport sends that value as
+`X-Api-Key`, with no Authorization or Cookie. No actual account or model is used.
+
+The provider binds 127.0.0.1 on port 0, caps request bodies at 1 MiB, rejects
+Origin, wrong paths/auth and excess requests, and emits fixed text SSE only.
+There are no generated tools. ACP advertises no filesystem/terminal client
+capability; every native permission request is denied, and the observed count
+was zero. No reviewer agent-file allowlist or native tool-isolation claim is
+inferred from this ACP run.
+
+Every native launch is wrapped in Seatbelt using the existing local-worker
+profile plus exact owned paths/port. Actual-home data and installed-binary
+writes remain denied. Controls prove private-provider TCP succeeds, an owned
+decoy port is denied, a named actual config cannot be read and the installed
+binary cannot be write-opened without truncation. The only extra runtime service
+is `com.apple.FSEvents`, needed for the native workspace watcher. An installed
+runtime preload control observes a private-file watcher event with that service;
+without it the same control reports EMFILE. No file limit, security setting,
+production permission or deadline was raised.
+
+The reused Node loopback guard is supplementary. The kernel port controls are
+the network boundary; an empty application log alone is not proof that no call
+was attempted. Process lifetime containment beyond observed owned cleanup
+remains unproven; this native run is not a disposable-runner attestation.
+
+## Observed next-turn procedure
+
+1. `initialize` returns protocol 1, name `Kimi Code CLI` and version 2.5.2.
+   `session/new` returns a session and model config option with current A and
+   both exact fixture choices. The adapter proves its process binding and
+   immutable baseline A.
+2. The private DB stores A, and actual `AcpPeer.deliver` sends the first prompt.
+   The provider sees `fixture-a` and holds a fixed text stream behind an explicit
+   release barrier. The adapter remains busy.
+3. The DB is changed to B while A is held. Latch status retains effective A and
+   reports desired B/pending next turn. The request observer sees no model
+   setter; the only provider request remains A.
+4. The fixture releases A and observes its normal completion, without cancel or
+   restart. On the next deliver, the adapter sends exactly one
+   `session/set_config_option` with `configId: model`, value `fixture-b` and the
+   bound session. Production parsing validates the response/config update.
+5. The second fixture request uses `fixture-b`. The prompt completes normally
+   and the latch reports B applied, with no pending revision. The exact observed
+   effect order through B is prompt, config setter, prompt.
+6. Clear removes the desired DB row. Status initially retains effective B with
+   pending next turn. The third deliver sends the original baseline A through
+   the standard setter, then the actual provider receives A. Final status has
+   effective A, no desired override and no pending next turn. The complete wire
+   sequence is `[A, B, A]`, with setter values `[B, A]`, three normal outputs,
+   zero cancels, zero turn failures and zero permission calls.
+7. Private config, device, MCP, synthetic credential and copied-binary hashes
+   match immediately after B, after clear completes and after owned stop.
+   Successful cleanup removes only the owned fixture.
+
+The original A/B leg passed first. A fresh three-prompt leg then retained every
+original assertion and the same 50 s operation/10 s stop budgets, extending only
+its exact expected request count from two to three. Existing provider/account
+configuration, launch argv and the person's real native home are not changed.
+
+## Real-home checks and failed attempts
+
+The selected actual config/credential snapshot has nine entries, with symlinks
+recorded without following. The passing probe's before/after digest is
+`297927630977dddf707dce6dd4af9cd561a38dcc2d42e3c2027f7660dba1d094`
+for the original A/B leg, and
+`938c4047672ae8a1144c45ffa9946653b1ed692c6edcba23d9b5f1919b3ff069`
+for the A/B/clear/A leg.
+The installed original binary is unchanged. There was credential-file drift
+between earlier metadata/probes, detected before any candidate spawn. That
+failed pre-spawn guard is retained, and no actual file was restored or edited.
+Writer attribution is unproven; there is no task-wide unchanged-state claim
+across those intervals. Each executed leg keeps its own before/after check.
+
+Two earlier native attempts failed before any provider request or setter, with
+owned stop and per-case actual config checks passing. The diagnostic attempt
+confirmed correct initialize identity/version, then native `session/new` failed
+with watcher EMFILE. A separate controlled watcher isolated the missing
+FSEvents service. The final fresh run kept every assertion and the same 50 s
+operation/10 s stop budgets and passed after that exact service was allowed.
+The synthetic auth-header assumption was corrected from installed source before
+any native provider request, not by accepting an unknown credential after a
+failure. Failed fixtures/logs are preserved privately.
+
+## Evidence and limits
+
+Workspace scratch `temp/task809-kimi` contains the probe/factory; `temp/task809`
+contains the controller, closed logs and case bindings. The passing result is
+bound to these SHA-256 values (the final clear leg root is
+`/private/tmp/ahub-809-o_nuxlfe`):
+
+| Item | SHA-256 |
+| --- | --- |
+| native probe | `df711ffd1e712141fef96096e89676971462765a8dea95eca8acddbce249f6cf` |
+| synthetic fixture factory | `02a8e172817af815c3247a6ca4c43b888775c3cf99b0d0ca02f02428270b90a8` |
+| root controller | `a9bf78022546b9c9ebe25c63586522476527b28b3c535547d625a8f189ad59ac` |
+| closed native result | `d0b63136b705952d5f0b29ee9b2fccbd9502e0393d4f056eb0b50354da3578d7` |
+
+Real provider/model behavior, actual accounts, other providers/platforms,
+the reviewer surface and installed-hub rollout remain unverified. Typecheck,
+unit tests, canonical DGX and hosted CI are separate PR gates; no pass is inferred
+from this native receipt and no verified stamp or release is performed here.

package/docs/verification/2026-11-08-kimi-tui-completion-1282.md

@@ -0,0 +1,45 @@
+# Kimi TUI completion facts (#1282)
+
+Date: 2026-11-08. Scope: exact native version Kimi Code 2.5.2 on macOS arm64, isolated Git projects and isolated `KIMI_CODE_HOME`, real model turns and the real hub control protocol. No prompt, answer, session id, task title, command or credential is reproduced here.
+
+## T0 native evidence
+
+- Ordinary turns write `turn.prompt(origin.kind)` and final `turn.ended(reason)`. A blocked first Stop produced only the intermediate `agent.turn.ended`; the final `turn.ended` and `prompt.completed` appeared only after the second Stop was allowed.
+- A real background process wrote `agents/main/tasks/<id>.json` with `status: "running"` and `endedAt: null`, then `status: "completed"` with a numeric end time. Its ordinary turn completed before the background process.
+- StopFailure produced `turn.ended(reason: "failed")` and a matching prompt failure. Interrupt produced `turn.ended(reason: "cancelled")` and `prompt.aborted`.
+- `TurnStarted.origin_kind` was `user` for person prompts and `task` for a background notification. `turn.prompt` may omit `promptId`; notification turns may also omit `prompt.completed`. The native `notificationId` or turn id is the correlation fallback.
+- TaskStarted and Notification hooks were not observed in these runs. Settlement therefore re-reads the native inventory and final turn instead of requiring a hook.
+- A launcher-scoped local plugin worked from `plugins/managed/agent-hub` and `plugins/installed.json`. Its record carries the launch id, not prompt data. Normal TUI exit removed the record and files; another plugin remained.
+- `spawnSync` blocked the launcher's control socket heartbeat. The production launcher now uses async spawn in the foreground process group.
+
+## Live implementation evidence
+
+- Ordinary person turn: one private `done`, with the correlated native turn end and no text in the completion sinks.
+- Real background `sleep 15`: no completion while the task file said running. One `done` appeared only after the task and notification turn had settled, without requiring TaskStarted or Notification hooks.
+- `hub_inbox`: a queued message was pulled and the person prompt that called the tool produced one `done`. The hub message itself opened no additional person run.
+- Earlier forced-close/restart probes produced one `interrupted` for the open run, never a duplicate on later reads.
+- `ahub results --json` exposed only ids, peer, outcome, times and `private: true`. The launch-scoped plugin was removed on normal exit and other plugins stayed installed.
+- Focused regression suites: 90 completion, agy, launcher and review-follow-up tests plus 36 full-gate failure-focused tests passed, with typecheck and bundle freshness. These covered the codec, completion flow, missing prompt ids, absent Stop/Notification hooks, unknown inventory, compat receipts and unverified-version behavior.
+- PR review follow-up: the version probe preserves a wrapper/interpreter prefix without launch-only model options. A shared-home plugin record carries its owner pid and process signature; an active or unknown owner is never replaced, and only a proven-gone owner is stale. Replacement and cleanup also share one fail-closed lock per native home, and setup failure always falls back to the plain TUI. `turn_end` is emitted for agy and Kimi native turns, a final row after the 2 s Stop deadline still settles, and an unknown task inventory no longer discards final-turn evidence. Quiet re-reads back off from 250 ms to 1 s.
+- Full Linux `scripts/check.sh --changed` at `8402dcd9c712e410f7f610e6271fe768894ac11e`: **12737 pass, 102 skip, 0 fail**, ending `check: OK`. The earlier full run's 10 failures were all fixed and re-run in the focused suites.
+- OCR delegation covered all 21 reviewable files at that head. Two preview/ownership findings were fixed with red/green plugin regressions.
+
+## Acceptance criteria
+
+- [x] AC1: blocked-Stop, delayed final output and stale-replay cases; Stop alone creates no completion.
+- [x] AC2: one unread completion only after final-turn readback and verified background quiescence.
+- [x] AC3: StopFailure becomes `failed` only after final-state readback; Interrupt is quiet; launcher loss/restart yields at most one `interrupted`.
+- [x] AC4: a real `hub_inbox` pull does not create a person-originated native turn; the person's prompt settles once.
+- [x] AC5: forged, stale, wrong-launch, wrong-session, wrong-cwd and replayed observations create no run, completion or receipt.
+- [x] AC6: active background work and unknown inventory never produce a premature `done`.
+- [x] AC7: no prompt, answer, hook error, task command or title reaches completion rows, events, logs or memory; native-person results are private stubs.
+- [x] AC8: only compat `kimi-tui` 2.5.2 enables the bridge; other versions keep existing TUI behavior with completion disabled.
+- [x] AC9: `scripts/check.sh --changed` passed at `8402dcd9c712e410f7f610e6271fe768894ac11e`, with 12737 pass, 102 skip and 0 fail. Live exact-version evidence above is complete.
+
+## Hardcoded-value calibration
+
+A fresh blind sample of 80 decided entries passed 69/80 (86.25%) after applying the published contract, external-input safety floor, operational default and test-seam distinctions. The new inventory constants were then classified; `bun scripts/inventory-hardcoded-values.ts --check` passed (3494 entries, 2489 classified, 1005 baseline).
+
+## Implementation boundary
+
+Hooks are candidates only. The daemon, current launch, native home, native session, project and current socket generation bind every observation. The transcript supplies origin and final outcome; background task files supply count or explicit unknown. Native-person results stay private. Headless ACP behavior is unchanged. An unverified TUI version or a launch without these readbacks declares no TUI settle.

package/docs/verification/2026-11-08-kimi-wire-yield-1283.md

@@ -0,0 +1,31 @@
+# Kimi sliced wire-log drain (#1283)
+
+Date: 2026-11-08. Scope: deterministic synthetic fixtures only. No personal wire log, account, model call or native session was used.
+
+## Baseline and after
+
+`scripts/benchmarks/kimi-wire-drain-1283.ts` creates three agents with the same append backlog and forces 16 minimum-sized reader slices. Baseline has no scheduler and retains the original synchronous 16-pass behavior. Sliced mode uses the daemon scheduler and a 0 ms continuation between slices.
+
+| Measurement | Baseline | Sliced |
+| --- | ---: | ---: |
+| Slices | 16 | 16 |
+| Drain wall time | 34.401 ms | 33.824 ms |
+| Longest synchronous slice | 34.373 ms | 3.296 ms |
+| Discovery calls | 32 | 32 |
+| Bytes read | 2,082,248 | 2,082,248 |
+| Yields | 0 | 15 |
+| Caught-up reports | 1 | 1 |
+
+These are one local run's raw values, not a production latency or percentage claim. Discovery and bytes are unchanged; each scheduled invocation returns after one bounded read/commit, and control traffic can run before the next slice. All 16 continuation callbacks are timed individually. The terminal offline read still drains synchronously before drop, and a failed attempt uses the bounded 250 ms follow-up instead of an unbounded 0 ms retry.
+
+## Acceptance criteria
+
+- [x] AC1: the same fixture reports before/after longest synchronous slice and discovery count, with raw values and no inferred percentage.
+- [x] AC2: a real daemon `status` request completed between two slices; the test asserts pending-slice ordering, not elapsed milliseconds.
+- [x] AC3: fault injection after reader offset advancement proves cancellation cannot discard the uncommitted slice; the delayed timer also contains an event failure and keeps its bounded retry.
+- [x] AC4: a new agent created between slices is discovered and counted by the next fresh validation pass.
+- [x] AC5: protocol, privacy, rotation, hard-link, shrunk-file, malformed-row and partial-line tests pass; earlier successful rows survive a later failure exactly once.
+- [x] AC6: concurrent cues remain serialized at one pending drain, and stop/session replacement cannot rebind the old session.
+- [x] AC7: `scripts/check.sh --changed` passed at `a9b777a947ab2636f36da704b71cae8dc157fb6e`, with 12698 pass, 102 skip and 0 fail, ending `check: OK`.
+
+Focused result: 43 tests across the benchmark, delayed-usage, daemon and wire suites passed, plus typecheck. Baseline/sliced receipt generation and the benchmark test also passed independently.

package/docs/verification/2026-11-08-live-model-override-1317.md

@@ -0,0 +1,250 @@
+# Live model override T1 evidence, #1317
+
+Task #808 implements person-owned desired model state and supported next-turn
+selection. This is source and fake-transport work. No model, real account,
+native profile, deployed daemon, release or machine trust was changed.
+
+## Contract and scope
+
+- Overrides live in the project hub.db and survive daemon restart. Runtime reset
+  clears them; retained state is bound by recovery feature/integrity admission.
+- CLI model set/clear/list is person-only, including agent-shell/live-test refusal.
+  Dashboard writes use verified settings-session identity, preview and confirmation;
+  expiry alone is not treated as a session identity.
+- The desired revision and an active turn's captured model are separate. Captures
+  happen before asynchronous preparation; acknowledgements bind their actual
+  adapter owner and turn, not a future turn id or a model string alone.
+- Conductor ruling on 2026-11-08 admits both CodexPeer app-server turn/start
+  paths. An explicit native client model wins, turn/steer is unchanged, and a
+  turn/start model becomes the native thread default. Clear removes the hub
+  override but does not invent an earlier native default.
+- T1 does not add ACP setters or native TUI authority. The supported factories
+  are host-marked; public capability text alone cannot claim a live setter.
+- Tier 3 instance/model/command/provider rules, native reviewer tool/isolation
+  fences and local budget/campus/observer safeguards remain in force.
+
+## Checks
+
+The worktree began at b97ee5af976e92b97d2eb55b8a1147908a83fac7. Local dependency
+preparation used pinned Bun 1.4.2 with a frozen lockfile (99 packages), with no
+pin or lock change. A bounded DGX structural query found ripwire unavailable in
+the image, so planning used the inspected source call sites instead. That query
+was not a compilation or test gate. Committed-head checks are recorded below
+when their results are available; no test pass is claimed yet.
+
+## Remaining evidence
+
+Focused fakes, canonical DGX and exact-head hosted CI remain unverified until
+recorded. No native/provider/model-backed run is claimed by those checks.
+
+
+## Initial committed checks
+
+- `c0640100a3ff4bf2ab583351ba6a2f26eb2290e0`: frozen DGX install then TSC
+  stopped at one possibly undefined model-boundary access. Inventory and tests
+  did not run. The guard now requires existence before comparing the owner.
+- `7ae86fcc726a70505107b11e445e8373321b8001`: the separate DGX inventory check
+  identified seven new keys. This is a failed inventory run, not a green gate.
+  No key was added to the baseline.
+
+The new thread-model cache cap, stored override count, pending preview count and
+confirmation TTL are operational limits on the hub's own retained state. Pending
+native RPC records, CLI response rows and incoming confirmation-token length
+are safety floors at input/proof-reader boundaries. The existing #844 token
+representation is reused unchanged in a pure leaf module; native adapters do
+not import the registry through instances, avoiding an initialization cycle.
+
+
+At `69974c37b53cc74bb6656b63648f6b8b07818754`, DGX typecheck,
+inventory and all 559 exact seed anchors passed. Runtime tests had 383 pass,
+3 existing platform skips and 1 failure across twenty files (3,821 assertions;
+124 s). The new Codex test requested steering after the RPC response but before
+its actual native `turn/started` observation. Its fake now supplies that barrier
+and asserts the steer uses the observed native turn id. No ownership guard,
+assertion or timeout was relaxed. The three existing #845 skips do not provide
+Linux-native sandbox evidence.
+
+Additional boundary checks before submission cover a saved override whose audit
+append fails (explicit saved-but-failed reply and readback/repair guidance), an
+older hub that advertises no model support (refusal before any model request),
+and model listings with retained removed peers. The model view has a display-only 512-row ceiling, with bounded collection
+of builtin, configured, external, active local and retained ids. Legacy native
+peer admission has no universal 64-peer cap, so a complete inventory is not
+assumed to fit. Overflow explicitly refuses list, marks model data unavailable in
+status/snapshot without breaking other fields, and leaves single-peer set/clear
+usable. No peer admission is narrowed and no truncated list is called complete. This does not raise the
+storage cap or change any existing timeout.
+
+
+The display path caches a scalar launch model only when a trusted supported
+factory registers its owner. Periodic model views do not call unsupported
+owners' recovery hooks or scan task history. The unavailable flag has fixed
+CLI/UI cause and repair guidance, and disables stale model controls.
+
+At `29f3be831399c0125ad9ea5bd4f117894505a760`, the new real fake-WebSocket
+ACK-order test reproduced a product defect: an older explicit-client ACK arrived
+after a newer hub model acceptance and incorrectly emitted `client-older` as the
+native choice. The named assertion failed normally (one case, seven assertions,
+4 s), without setup/compiler/timeout failure. This red checkpoint intentionally
+contained the new test and unchanged Codex source; other pending refinements were
+not claimed tested. Its eventual fix and green evidence are recorded separately.
+
+
+At `4e10add8e7f6ad446aaf42278ea46ceb86fc77df`, typecheck, inventory and
+all 559 anchors passed. The Codex ACK-order regression was green (139 ms),
+including unknown-default cases, with its original failing assertion preserved.
+The selected seven files had 125 pass and one new fixture failure (1,700
+assertions; 61 s): a counter included legacy status recovery-hook calls rather
+than isolating the new model view. The correction checks the model-list path
+immediately and executes the actual cached fallback projection separately.
+The legacy status behavior is not rewritten or counted as a model regression.
+
+A second named red test at `d92ea42aa1d0de528dba014b771895b672e2ad44`
+used the real authenticated fake Pi bridge and an owned process signature. It
+held the public setter return after a successful native ACK, withdrew roster
+ownership, then observed an incorrect `applied` callback before the existing
+epoch guard (expected zero, observed one; five assertions, 4 s). The source moves
+that callback after the existing post-ACK guard. Cancellation/shutdown precede
+the fixture's delivery join; the owned process is confirmed exited. This is
+synthetic host/protocol evidence, not a native account or model qualification.
+
+The new Codex steer test also uses the fake's existing file gate to hold turn
+completion until its native-id/model assertions finish, replacing a 100 ms
+completion race without changing any product timeout or shared fake behavior.
+Final unavailable banners describe bounded-read failure generically, because
+store-read failure and catalog overflow must not be confused.
+
+
+At `ded9db733f0a0b7b8fea70934d41d051afd1da94`, DGX typecheck, inventory
+and all 559 anchors passed; all 122 selected Codex/Pi/controller/CLI/UI tests
+passed (1,475 assertions, five files; exit 0 in 53 s). This includes the prior
+ACK-order red test and the invalidated Pi ACK red test. Other adapter, tier 3,
+reset and HTTP-auth tests passed in the earlier wider run; no earlier failed
+whole run is relabelled as green.
+
+Final state/UI edges add a captured-revision check for clear before its first
+ACK, and per-component draft/request generations for model confirmation. Editing
+the draft or beginning a new preview invalidates old tokens and all late success,
+error and finally effects. Preview metadata must match the exact set value or
+null clear. Server refusals retain bounded plain error/repair text through the
+existing text-only surface; unsafe or malformed replies use fixed fallbacks.
+The UI error-text ceiling is a safety floor, not a new authority or model bound.
+
+
+At `8333ffcdfe05f373a7c58fa192a4efd7123c138e`, typecheck and inventory
+passed; all 25 changed state/UI tests passed (237 assertions, two files;
+39 s). This covers pending clear before first ACK, strict draft/token binding,
+late preview/confirmation success/error/finally, and specific safe server repair
+text without claiming native application.
+
+Main `6da56c7a3cc697d9401903b827897148e05826e9` was merged cleanly for
+integration, including the #1318 macOS typecheck heap fix. The model runtime,
+adapter, CLI/UI, package, lock and generated bundle bytes are unchanged from the
+passing source checkpoint; incoming changes are Orca O2 and the CI fix. No
+unmerged fix branch is imported. Two new seeded guards target person-only model
+control and the reproduced accepted-ACK ordering defect, using existing named
+Linux tests. Their actual seeded results follow separately.
+
+
+## Integration checkpoint and remaining gate
+
+At `15cb959eab3b7e5796e3df4c50046d8447fe801c`, all 561 anchors matched.
+Seed shards 48/64 and 49/64 passed all 18 original-green / named-mutant-detected
+pairs, including both new model guards (46 s total). The separate existing
+Office/role/pet/motion/UI integration tests passed 101/0, with 140,310 assertions
+across five files (17 s). Logs: scratchpad `temp/task808-seeds.log` and
+`temp/task808-ui-integration.log`. These are focused shards, not a claim that
+all 561 mutants ran.
+
+The initial 44-file independent source/test/doc review had no confirmed
+Important finding; its CLI 30-second timeout nit was corrected to the repository
+20-second ceiling. Subsequent delta reviews covered all nongenerated changes
+and confirmed the model ACK, cached metadata and UI fences. The unavailable
+cause nit is fixed. The generated bundle is checked by the gate rather than
+claimed manually reviewed. A provisional token-newline alert was retracted
+against the actual pinned runtime and ECMAScript semantics, with no source change
+or pass claim based on it.
+
+The final report-only head starts canonical `scripts/check.sh --changed` on
+DGX. Its result and exact-head hosted CI remain unverified until recorded. The
+known inherited Herdr `/home/dev` fixture defect (#807) is outside this feature.
+No test is excluded or weakened for it. Native/provider-backed model acceptance,
+real UI browser interaction and installed-hub rollout remain unrun. No release,
+upgrade, restart or model change was performed on the person's running hub.
+
+
+## Unchanged covering contracts
+
+The parent agent-hub goal spec is unchanged: this refines existing native
+adapters and person-owned control without changing task/peer authority,
+account ownership or the deployment boundary. The owning adapter and
+architecture specs carry the new model state, turn and evidence contract.
+The bus spec is unchanged: reset clears an additional independent runtime table,
+while message addressing, queue/journal disposition, receipts, TTL, broker and
+reset admission semantics remain as before. Model selection is not a task or
+delivery effect.
+
+This acknowledgement was omitted from the first board completion. The final
+document-only correction carries the same runtime and test bytes. Canonical
+verification continues at parent `2f311bf61c6c77636aeb54a5ad249838b8ea0ee5`;
+it is not an exact-head canonical pass for the corrected document head. Hosted
+CI must verify the final head before merge. No duplicate canonical run or empty
+retry commit is introduced for this bookkeeping correction.
+
+## Reviewer regression corrections
+
+Review of `54546e9d` found two regressions the earlier focused set missed:
+the generic reviewer factory supplied a model getter to unsupported Claude and
+Kimi reviewer surfaces, and a client-forwarded Codex start rejected before any
+turn began retained its captured model choice. Both are operational regressions,
+not unavailable evidence. The corrected fixtures exercise actual daemon reviewer
+starts and rejected proxy requests followed by a corrected desired model.
+
+The original canonical run at `2f311bf6` reproduced the Claude reviewer failure
+in `reviewer-pool-daemon.test.ts`. It also reported a `#733` catch-up test failure.
+After those failures and this review, the owner interrupted that obsolete run
+with SIGINT; it exited 130 after 592 seconds. It is cancelled, not a full-suite
+pass, and no test failure is erased or counted as fixed merely by cancellation.
+
+The correction also acknowledges Pi selections only after prompt acceptance,
+and identifies a cleared Codex override retained by the native thread as
+`native thread default (was override)`. The latter describes known accepted
+history; clear still cannot reconstruct a previous thread model. Unsupported
+reviewer surfaces keep their original no-override review behavior and do not
+gain a model-setting capability.
+
+Concurrent definitive rejections drain a single bounded retirement candidate,
+including when an explicit client-model request is the last one to reject.
+Native acceptance or a native start protects the current boundary. Reused RPC
+ids remain ambiguous: their tombstone is retained until client reattachment,
+rather than treating the first response as proof all duplicate requests failed.
+No retirement callback grants model authority or overwrites an explicit client
+choice.
+
+The first correction check at `f7e84a200a494c4566f71915260f96dbf0318e5a`
+passed typecheck, inventory and bundle comparison, then reported 172 pass and
+1 fail (2,100 assertions, ten files; remote exit 1 in 76 s). The failure was in
+the new Pi acceptance fixture: its synthetic settlement omitted the required
+native generation, so the existing fence correctly ignored it. Commit
+`8f8c9794f0b71d52bca6a8983598e34968edd134` supplies the actual generation-bound
+start/settled lifecycle. It changes only that fixture, preserving every existing
+assertion, deadline and production lifecycle check.
+
+Committed-head DGX verification at `8f8c9794f0b71d52bca6a8983598e34968edd134`
+passed typecheck, inventory (3,496 entries; 2,491 classified; unchanged 1,005
+baseline entries), bundle comparison, and all 173 tests across ten files
+(2,103 assertions). This includes the original failing reviewer daemon suites,
+the actual proxy correction, concurrent rejection cases and Pi acceptance and
+rejection. Seed shards 48/64 and 49/64 passed all 18 original-green /
+named-mutant-detected pairs, including both model guards. The combined remote
+command exited 0 in 109 seconds; log: `scratchpad/temp/task808-review-final-focused.log`.
+
+The independent correction review covered all 16 nongenerated changed files
+and found the explicit-last rejection gap before verification; it was corrected
+and reread with no further finding. The generated bundle is verified by
+comparison. The final report-only head has identical runtime, test and script
+bytes to that focused-tested commit. Its canonical changed-scope gate and
+hosted exact-head CI remain separate, unverified gates until their results are
+recorded; neither the focused pass nor the interrupted earlier run substitutes
+for them. Native/provider-backed acceptance and real dashboard interaction
+remain unrun.

package/docs/verification/2026-11-08-qwen-0269-acp.md

@@ -0,0 +1,138 @@
+# Qwen Code 0.26.9 ACP receipt
+
+Date: 2026-11-08. Task #811, Refs #843 and #1317. Repeats the
+[0.26.8 account-free ACP procedure](2026-11-06-qwen-0268-acp.md) on macOS arm64.
+
+**Decision: add exactly 0.26.9 to COMPAT.qwen.verified.** Native ACP, the actual
+published permission handler, network-denial controls, owned cleanup and the
+separate reviewed optional lifecycle replay passed. This qualifies no other
+version or native surface. Runtime model setters belong to #1317 T2 and are
+not proved by this receipt.
+
+## Artifact
+
+The [official release](https://github.com/QwenLM/qwen-code/releases/tag/v0.26.9)
+and exact [npm metadata](https://registry.npmjs.org/@qwen-code/qwen-code/0.26.9)
+identify commit `600aff0592bcfc21668ca4aba95a5b20c6491b86`.
+The private npm lock's SRI equals that metadata. No global install, update or
+trust change was performed.
+
+| Binding | Value |
+| --- | --- |
+| Package | `@qwen-code/qwen-code@0.26.9` |
+| npm integrity | `sha512-2orVsP3Dr01gk38STbYTWcFZeXftc0QXDHhglK7YPsIwgmumvnJeTAu1N00esRUwuLcevZ8k4godLwypDKb1LA==` |
+| package.json SHA-256 | `47f5ad2df1ba61df66e8ce409e65beb01cc3fcf551acaa028ca1d0904b5cba09` |
+| cli-entry.js SHA-256 | `113efe4104a9fc66f507d34bfd6abbd896ceb77de47f4b468a0825a327fdc6a5` |
+| chunks/acpAgent-GNBAKZNO.js SHA-256 | `a856ab4bbd2fceabc2430ef3a5689fd404b70d766c8f1fc3715632ff0afd4f8a` |
+
+Source for the committed producers was `d87dfe25d` (the branch's main base).
+The collector imports `runQwenProofs` and `runBoundedReceiptCommand`; it does not
+copy their assertions or rewrite installed candidate code. The permission leg
+uses the producer's exports-only temporary chunk copy and removes it afterwards.
+Original package and producer hashes matched before and after both native runs.
+
+## Isolation and cleanup
+
+- A fresh 0700 root under `/private/tmp/ahub-811-...` holds the private npm prefix,
+  HOME, cwd, TMPDIR, QWEN_HOME, QWEN_RUNTIME_DIR and all XDG config/cache/data/state
+  paths. Only fixed runtime PATH and locale values enter helpers. No account,
+  OAuth state, personal profile, real key, MCP project or agent/session marker
+  was copied. Authentication uses only the producer's synthetic fixture key.
+- The installer uses empty user/global npm configurations and its own cache.
+  Seatbelt starts from `src/local/sandbox.ts`, then denies actual-home data and
+  global writes, allowing runtime code reads and writes only in the owned root.
+  Only the install phase permits package downloads. Both native proof phases
+  deny all kernel network access, in addition to the unchanged Node preload.
+- `/usr/bin/true` passed. Read-open of a named actual configuration and write-open
+  of the installed Node executable, without truncation or writing bytes, were
+  denied with Operation not permitted. These are receipt-controller controls,
+  not a general sandbox attestation for the release.
+- The before/after configuration snapshot covers regular files smaller than
+  2 MiB below the actual `.qwen` and `.pi/agent`, excluding sessions, logs, cache,
+  install, bin, node_modules and .git; symlinks are recorded without following.
+  All 2,318 entries matched, aggregate SHA-256
+  `37e4d8a5f0fe0acbbbecc87d3bd57ee6ea6b9c6dccfc7ebefcc1a3a37232464b`.
+  The person's real configuration was unchanged after install and after native
+  verification. The snapshot is deliberately not a hash of every session/log.
+- Every native command returned bounded output and confirmed its owned stop.
+  The ACP producer reports `groupGone: true`, leader exit -15, before and after
+  lifecycle replay. A final process inventory found no private-root survivor.
+  Detached process lifetime containment remains unproven; a native Seatbelt
+  run is not a disposable-runner attestation. No unknown process was signalled.
+
+## Native ACP and permission legs
+
+The unmodified promoted `qwen-acp.py` ran with `--acp --bare --advisor off`,
+synthetic OpenAI auth, `fixture-model`, loopback port 9 and telemetry disabled.
+No ACP prompt was sent and no model or fixture completion was requested.
+
+- `initialize` returned protocol 1 and exact `qwen-code` / `Qwen Code` / 0.26.9
+  identity. Only the expected terminal OpenAI auth method was offered.
+- `session/new` returned a nonempty session identity, only the fixture model,
+  and initial mode `default`. The advertised ids include the hub's mapped subset
+  `default`, `auto-edit`, `yolo`. All four `session/set_mode` calls in
+  `default -> auto-edit -> yolo -> default` acknowledged successfully.
+- The unchanged preload's positive denial control passed before candidate code.
+  Six startup network API attempts were blocked in each run; no connection was
+  allowed by the kernel profile. This does not infer absence of attempted calls
+  from an empty log.
+- `qwen-permission.mjs` drove the actual published `SubAgentTracker` handler,
+  using only synthetic clients, tools and events. Two permission requests had
+  the exact options: project/user `allow_always`, `proceed_once` / `allow_once`,
+  and `cancel` / `reject_once`. The allow-once callback returned `proceed_once`,
+  cancellation returned `cancel`, and an unoffered option was rejected. No
+  permission-fixture network attempt was recorded. No model-generated tool call
+  or actual board approval was involved.
+
+## Optional lifecycle and repetition
+
+The optional `@qwen-code/audio-capture` install script is byte-identical to the
+previous reviewed script, SHA-256
+`bf91a3db08fdaf1622a0fa938f1f0e29cef712586ca13c2b0ac2422dd3f916fd`.
+It invokes `node-gyp-build` and deliberately exits 0 even when the optional
+microphone backend is unavailable. Normal private npm installation passed
+without disabling scripts. An explicit replay under the private HOME, no-network
+Seatbelt profile and build concurrency two also exited 0 with owned cleanup.
+This proves the reviewed lifecycle procedure, not microphone functionality.
+
+After replay, new private HOME/cwd/XDG paths repeated all ACP and permission
+assertions successfully. The generic machine summary still calls the lifecycle
+leg `not-run: source-review-required`; the separate reviewed/replayed control
+above supplies that evidence, without changing the producer's result or claiming
+automatic harness eligibility.
+
+One post-lifecycle controller attempt failed before any native command: Bun had
+already created its HOME cache, conflicting with the collector's directory
+creation. The repaired controller validates precreated owned 0700 HOME paths
+and keeps native proof/output creation exclusive. The failed setup log is kept;
+no protocol, refusal, integrity assertion, timeout or production code changed.
+
+## Separate surfaces and not verified
+
+`qwen-dual` needs its own 0.26.9 receipt. Its input-file/json-file TUI protocol,
+interruption, permission and resume behavior is distinct from ACP. The
+[0.26.8 dual-output check](2026-11-06-qwen-0268-dual-output.md) did not qualify
+that version, and this ACP run supplies no missing TUI proof. Its verified set
+remains 0.26.1. No remote/Linux, Intel Mac, real account/provider/model, runtime
+model setter, real model permission call, microphone or TUI leg is claimed.
+
+Committed-head DGX validation and hosted CI are separate PR gates, recorded in
+the PR/task completion. No `docs/verified.json` stamp, release or production
+upgrade is part of this change. The temporary prefix is retained privately for
+the independent T2 setter experiment, not installed into the person's profile.
+
+## Evidence fingerprints
+
+Closed results and controller sources are in workspace scratch `temp/task811`.
+The underlying installed prefix and synthetic native artifacts remain in the
+owned temporary root while T2 is in progress.
+
+| Evidence | SHA-256 |
+| --- | --- |
+| private installation result | `447e5194eec456e61c35ac38ca042e4d21eded4040af0585a03b351678ae7a5c` |
+| first native collector result | `498e672a133d0479dec564f0e0d3eb7022b2ad97e32a97c79835e693d7784f56` |
+| optional lifecycle result | `e27602dc5fe10a84c6e54219d460d7cb198a8ffd6dbc2bcbce4b67118878e4c5` |
+| post-lifecycle collector result | `4586096e28cf5939f059e11350d8b3c3e89e33fd265c7db0b17d1b7e226a3fa4` |
+| final configuration snapshot | `22aabd64a69a6ddef7f5a2a0915ada14849f37295d531f70c9626f860b44268f` |
+| post-lifecycle ACP result | `0eda1b826007ae53dbca2b41668331d728b2791fa39942e4d468d4160fca5566` |
+| post-lifecycle permission result | `e6ebfbf1572713288bc9eed11071e5228273bf5087a0b8cdf5767573f051ac2e` |