@staix/agent-hub 0.34.1 → 0.35.0

package/docs/verification/2026-11-08-qwen-0269-model-setter-1317.md

@@ -0,0 +1,91 @@
+# Qwen 0.26.9 ACP model setter, failed clear
+
+Date: 2026-11-08. Task #809, Refs #1317 AC4. **Failed:** the original model was
+not restored on the next prompt. Qwen has no production live-setter capability
+in this change. General compatibility qualification is separate, in
+[the 0.26.9 ACP receipt](2026-11-08-qwen-0269-acp.md).
+
+## Exact artifact and isolation
+
+The installed macOS arm64 package is `@qwen-code/qwen-code` 0.26.9, gitHead
+`600aff0592bcfc21668ca4aba95a5b20c6491b86`. Its package SRI is
+`sha512-2orVsP3Dr01gk38STbYTWcFZeXftc0QXDHhglK7YPsIwgmumvnJeTAu1N00esRUwuLcevZ8k4godLwypDKb1LA==`.
+A private package already qualified by #811 runs with Node 24.18.1. The package
+manifest, CLI entry and ACP module hashes match that receipt before and after.
+The original package and selected real `.qwen`/`.pi` configuration snapshot are
+unchanged during this probe (2,318 entries, digest
+`4b3f2fb1cda310ba624f7854c6d5881fc7eff45f368268c884cf6493bea7cfa8`).
+This is a per-probe check, not a claim that other sessions made no changes
+between the earlier compatibility receipt and this one.
+
+Fresh 0700 private directories provide HOME, cwd, TMPDIR, XDG and tool homes
+before imports. The private trust file admits only this fixture's exact version;
+no machine trust is changed. Seatbelt denies actual-home data and global runtime
+writes. Positive exact-provider TCP and negative owned-decoy TCP, actual-config
+read and installed-binary write-open controls pass. The Node watcher control
+passes without raising file limits. No real account, credential, model or
+personal profile is used or modified.
+
+The synthetic OpenAI provider has two declared models, A (`task809-a`) and B
+(`task809-b`), on the same loopback endpoint and synthetic key. Its bounded fixed
+SSE responses generate no tool calls. Origin, wrong auth/path, oversized bodies,
+unexpected models and excess requests fail the probe. Native permissions are
+denied; none were requested. Process cleanup is confirmed, while detached
+lifetime containment remains unproven.
+
+## Actual adapter and observation
+
+The probe uses the production `AcpPeer`, `ModelOverrides` and
+`ModelOverrideLatches` at source `7c86077e89f790af0fd444b8ca9bd90e8d0bc09f`.
+A transparent observer invokes the original RPC with unchanged arguments and
+returns the same promise. It records bounded method/model ids only.
+
+Qwen advertises provider-qualified wire ids `task809-a(openai)` and
+`task809-b(openai)`. The probe uses an exact reversible suffix codec for these
+unique fixture ids. This is neither a production admission nor a display-name
+or hashed-route selector. Matching an auth type alone does not prove that two
+arbitrary native presets share an endpoint or account.
+
+1. The first ordinary user prompt uses A. Desired B is written while A is held;
+   the running A request is unchanged and no setter is sent during it.
+2. The next prompt sends `session/set_config_option`, `configId: model`, value
+   `task809-b(openai)`. Native acknowledgement precedes a request using B.
+3. Clear removes the desired row. The adapter sends the original baseline
+   `task809-a(openai)` and receives acknowledgement, but the third ordinary user
+   prompt still requests B. The required wire sequence A/B/A is **A/B/B**.
+4. The fixture refuses that third unexpected model and reports failure. It does
+   not count the resulting turn as completed or as a passing clear. Two prior
+   delivery ids completed. Owned stop succeeds and private settings remain
+   byte-identical immediately after B and after stop.
+
+All three requests are ordinary prompts: message counts 2, 4 and 6, with user
+counts 1, 2 and 3. No response-format/title schema is present. Auto-title is
+explicitly disabled before startup. This excludes an extra background title
+request as an explanation for this final sequence. The underlying native cause
+is not claimed here; the observed ACK is insufficient to certify clear.
+
+## Earlier setup failures
+
+- An initial watcher control used an immediate throwing evaluation before the
+  asynchronous watcher could answer. It failed before native ACP started.
+  Replacing only that control evaluation with `void 0` established the event.
+- A subsequent probe reached A/B but its settings byte fence failed. The native
+  loader added `$version: 4` and formatting; model.name stayed A and all original
+  fields were equal. That run's extra B request was unclassified. The final
+  fresh fixture declares the current schema before its original hash and
+  disables the documented auto-title path before startup. No assertion, request
+  cap, timeout or clear requirement was removed.
+
+## Evidence and limits
+
+The final private root is `/private/tmp/ahub-809-r2l7mnlg`. Its closed result is
+retained in scratch `task809/qwen-schema.log`, SHA-256
+`1f71465d1bfb87705132ec4d0b429a51eb75ef32577e069e3a312ebc8efe01d7`.
+The scratch probe SHA-256 is
+`e0af80d8b3d9cf013794908e619f4579c90460d181024c4857b62472038d1c30`;
+controller SHA-256 is
+`d54e5f733b25bc4d6ee9e96a24e8ceb59871ba3eec44d47bbf4cc558aac611af`.
+These identify uncommitted producers, not a committed reproducible proof module.
+No native daemon/dashboard journey, real provider/account, Linux, TUI,
+qwen-dual, preset migration or general provider-identity qualification is made.
+No COMPAT, trust, reviewer isolation or verified stamp is changed by this task.

package/docs/verification/2026-11-09-0.35.0.md

@@ -0,0 +1,129 @@
+# 0.35.0 release verification
+
+This record covers release preparation and source review. It claims no installation, no running-hub upgrade to 0.35.0 and no live TUI launch.
+
+## Candidate
+
+Version 0.35.0, prepared from main 44410b11 (51 commits since v0.34.1, 28 of them `feat`; bump rule: minor). The release commits carry the version, the CHANGELOG section, the bundle and the documentation stamps.
+
+## Reviews
+
+Pull requests named by the commits since v0.34.1: 51 PRs (#1339, #1336, #1337, #1335, #1334, #1327, #1323, #1321, #1325, #1313, #1309, #1322, #1315, #1316, #1302, #1319, #1301, #1300, #1314, #1312, #1311, #1306, #1291, #1295, #1305, #1304, #1298, #1299, #1294, #1297, #1286, #1303, #1308, #1293, #1290, #1276, #1296, #1289, #1288, #1272, #1285, #1270, #1275, #1267, #1264, #1271, #1265, #1269, #1259, #1258, #1256). #1280, #1307, #1292, #1284, #1262, #1268, #1261 and #1263 appear in commit subjects as issue references, not merged PRs.
+
+Every PR merged with its single exact-head `check` run green and no unresolved review thread (GraphQL `reviewThreads.isResolved`, 0 open on all 51). 40 merged at the head their hub approval bound. 10 merged at a later head (below). #1271 had no hub_review: a jcode review task read its final head. Skipped ancillary jobs are not test proof.
+
+| PR / task | Review | Approved and final PR head | Merge commit | Hosted CI |
+| --- | --- | --- | --- | --- |
+| [#1339](https://github.com/STAIxBWLB/agent-hub/pull/1339), task 828 | claude (hub review) | `df7dc01a1ad7bd66bf9fc5793b357c725ee08398` | `44410b11b191ad19438e2277867aaf41714b3e7c` | [5 success, 5 skipped](https://github.com/STAIxBWLB/agent-hub/actions/runs/42554238313), identical-tree reuse of full gate [16 success, 2 skipped](https://github.com/STAIxBWLB/agent-hub/actions/runs/42553898322) at `3f13e162` |
+| [#1336](https://github.com/STAIxBWLB/agent-hub/pull/1336), task 817 | claude (hub review, 1 changes_requested round) | `b9e9e96a4e262156302e6200a838ecd5ab6d45a9` | `cd2080ecf8e54145c34ec8259ec35fa4909c3b7d` | [16 success, 2 skipped](https://github.com/STAIxBWLB/agent-hub/actions/runs/42536192039) |
+| [#1337](https://github.com/STAIxBWLB/agent-hub/pull/1337), task 829 | claude (hub review) | `7e951ea411907f67aa2ba8524108eef4f5fa7dd5` | `499d276be95ab2ed5b20b08168f53792e0f072ce` | [16 success, 2 skipped](https://github.com/STAIxBWLB/agent-hub/actions/runs/42537668703) |
+| [#1335](https://github.com/STAIxBWLB/agent-hub/pull/1335), task 827 | claude (hub review) | `57cc2bd8a320cae09223aa9f6399a54726c83828` | `0ffc889b763c87a52dff19f8d2e4845ba62f7864` | [16 success, 2 skipped](https://github.com/STAIxBWLB/agent-hub/actions/runs/42527180362) |
+| [#1334](https://github.com/STAIxBWLB/agent-hub/pull/1334), task 816 | claude (hub review, 1 changes_requested round) | `8b3671a58af43a0d6c7defd959c0166f1ff91d60` | `d620d6318f13aaee1ecb0bb05cdc62ba2b7384f5` | [16 success, 2 skipped](https://github.com/STAIxBWLB/agent-hub/actions/runs/42523528679) |
+| [#1327](https://github.com/STAIxBWLB/agent-hub/pull/1327), task 813, task 814 | claude (hub review); final approval on task 814 | `0539f82b2d1984b250a317325c498209060a294d` | `a403eb23ffb6bd852ef4cee2b6733a658f5de0c3` | [16 success, 2 skipped](https://github.com/STAIxBWLB/agent-hub/actions/runs/42475335654) |
+| [#1323](https://github.com/STAIxBWLB/agent-hub/pull/1323), task 809 | claude (hub review) | `001ca0d6690bb2eb400f40985ad8fc31252db3f2` | `90292b7dba8f8bbbb1e3134c909174fd8be5a589` | [16 success, 2 skipped](https://github.com/STAIxBWLB/agent-hub/actions/runs/42467415994) |
+| [#1321](https://github.com/STAIxBWLB/agent-hub/pull/1321), task 808 | claude (hub review, 1 changes_requested round) | `3801132dd2f4d6089a5676d024d45093edd3b5c3` | `8dfa2e44798e8fb8eb522ae4495a5bd9590b4fa2` | [17 success, 2 skipped](https://github.com/STAIxBWLB/agent-hub/actions/runs/42460676156) |
+| [#1325](https://github.com/STAIxBWLB/agent-hub/pull/1325), task 812 | claude (hub review) | `e2deb5af7750f899f394ae7c31081413f48ec827` | `e28625c5653e09ddae5f6d01f0db638c1d52e4e0` | [17 success, 2 skipped](https://github.com/STAIxBWLB/agent-hub/actions/runs/42462300859) |
+| [#1313](https://github.com/STAIxBWLB/agent-hub/pull/1313), task 804 | claude (hub review, 1 changes_requested round) | `f9df413d6a6e6f4350a8ea45d4a1e23092c7cdfc` | `cfa4e138a91043ed6e68db892ae8e2b6ea240301` | [16 success, 2 skipped](https://github.com/STAIxBWLB/agent-hub/actions/runs/42453969408) |
+| [#1309](https://github.com/STAIxBWLB/agent-hub/pull/1309), task 803 | claude (hub review, 1 changes_requested round) | `315b89fa55bc31347dbbc4e5484eaa0a56034e07` | `f2c676f87e9bb135c06df63f76fd87f32e3a7906` | [16 success, 2 skipped](https://github.com/STAIxBWLB/agent-hub/actions/runs/42453962880) |
+| [#1322](https://github.com/STAIxBWLB/agent-hub/pull/1322), task 811 | claude (hub review) | `7411b9823f452abf90f68fceed50e9e3dacbf25d` | `85354cdf609455e55487afbf3ea8c99ae5ffd00c` | [17 success, 2 skipped](https://github.com/STAIxBWLB/agent-hub/actions/runs/42449700175) |
+| [#1315](https://github.com/STAIxBWLB/agent-hub/pull/1315), task 709 | claude (hub review, 1 changes_requested round) | `ad8d0785003495c3858e30ea3918b5bb618bbb50` | `013e8785b4d2c080973d7b6d61176fc13a522e73` | [17 success, 2 skipped](https://github.com/STAIxBWLB/agent-hub/actions/runs/42447527293) |
+| [#1316](https://github.com/STAIxBWLB/agent-hub/pull/1316), task 807 | claude (hub review, 1 changes_requested round) | approved `f7f8301b89f851ad29c0887a442b9542a5eb944c`; final `0882ef79a421111186f1b07c067c683342b7e4c0`: final adds only a clean merge of main (`0882ef79`, no conflict resolution) | `7c12c43788f03088258cbeb5c5f10b34862e3097` | [17 success, 2 skipped](https://github.com/STAIxBWLB/agent-hub/actions/runs/42447423362) |
+| [#1302](https://github.com/STAIxBWLB/agent-hub/pull/1302), task 792, task 805 | claude (hub review); final approval on task 805 | approved `a5d2b81c3f5abc2a7134da98d867ffc7a7b9402a`; final `13ebde3b1ac9c3f16aca06638c6edf77e4b9c329`: final adds only a clean merge of main (`13ebde3b`, brings #1319; no conflict resolution) | `d87dfe25dedf9473f44097b9a2bf55dd4477915f` | [17 success, 2 skipped](https://github.com/STAIxBWLB/agent-hub/actions/runs/42446078169) |
+| [#1319](https://github.com/STAIxBWLB/agent-hub/pull/1319), task 810 | claude (hub review) | `6f8f1066b88a87d1357560443dcc84e314d9ee59` | `6da56c7a3cc697d9401903b827897148e05826e9` | [16 success, 2 skipped](https://github.com/STAIxBWLB/agent-hub/actions/runs/42441448758) |
+| [#1301](https://github.com/STAIxBWLB/agent-hub/pull/1301), task 791 | claude (hub review) | approved `72751436a880baf83c2648e527f6ddebc7265254`; final `74b44452a8f5020e58a6982cbc576515e3fe9be4`: final is a rebase of `aad7ba51` (O2 replayed onto approved O1 plus the stale-reply fix, filed as task 805 phase B), which has **no board approval**; the last approval on the O2 code is `72751436` (task 791) | `276050764fd432bac0f98bab78773f271da2f85f` | [16 success, 2 skipped](https://github.com/STAIxBWLB/agent-hub/actions/runs/42438726108) |
+| [#1300](https://github.com/STAIxBWLB/agent-hub/pull/1300), task 790, task 805 | claude (hub review): task 790 approved the stacked O1 head `f579cc5b`; task 805 (O1 review fixes for two connector threads; its PR binding later moved to #1302) approved the final head | `6dc329c9d1fa28982302c3e62c2e3a51e47c5ba1` | `b97ee5af976e92b97d2eb55b8a1147908a83fac7` | [17 success, 2 skipped](https://github.com/STAIxBWLB/agent-hub/actions/runs/42433965087) |
+| [#1314](https://github.com/STAIxBWLB/agent-hub/pull/1314), task 801 | claude (hub review) | `f8831010cfcea76c08819dc29d203cdfbb23a20b` | `b0396f1fc762da5f764fe814e879a1c8b7af2305` | [16 success, 2 skipped](https://github.com/STAIxBWLB/agent-hub/actions/runs/42435439160) |
+| [#1312](https://github.com/STAIxBWLB/agent-hub/pull/1312), task 802, task 806 | claude (hub review); final approval on task 806 | `6b09587eb1e2317d872de1d80620c27fc29afed4` | `b4853aaa1b299266d7469ff58d1c3b4eae1ef331` | [17 success, 2 skipped](https://github.com/STAIxBWLB/agent-hub/actions/runs/42434045692) |
+| [#1311](https://github.com/STAIxBWLB/agent-hub/pull/1311), task 800 | claude (hub review, 1 changes_requested round) | `7edbe7854bb6ccfd529ac81c65df6c9d2c0e424f` | `497aa61a922aa03b1298f96d82d931280c82ce9c` | [17 success, 2 skipped](https://github.com/STAIxBWLB/agent-hub/actions/runs/42425430114) |
+| [#1306](https://github.com/STAIxBWLB/agent-hub/pull/1306), task 796 | claude (hub review) | approved `8fef8a678d66422c67e792672694b4e936f7fe55`; final `276877463453af250e92d9384ad08d1b5251bf73`: final is a patch-identical rebase onto main (range-diff `=`) | `b3d3167a4c093f3164c7e399c9ad9b30162e4489` | [17 success, 2 skipped](https://github.com/STAIxBWLB/agent-hub/actions/runs/42427614535) |
+| [#1291](https://github.com/STAIxBWLB/agent-hub/pull/1291), task 783 | claude (hub review) | `7fdcab5847239074d73b0f2e9132bca5e23b0ec8` | `4fb4f7e7cf873dcce3b87c87ce0b07daecb17626` | [16 success, 2 skipped](https://github.com/STAIxBWLB/agent-hub/actions/runs/42425278502) |
+| [#1295](https://github.com/STAIxBWLB/agent-hub/pull/1295), task 798 | claude (hub review, 2 changes_requested rounds) | approved `1e6da1ee221acd601fa28201c8cd0081d8214566`; final `5032c7a0f5eb8698da3c57af79a1ab7207103036`: final adds merges of the stack bases and main only, no conflict resolution | `a09806ed9d0454b3c1380ae53d34a4a78e80b0d0` | [17 success, 2 skipped](https://github.com/STAIxBWLB/agent-hub/actions/runs/42417684815) |
+| [#1305](https://github.com/STAIxBWLB/agent-hub/pull/1305), task 795 | claude (hub review, 1 changes_requested round) | approved `6a64ab64aa32ea4b649a1245ee8105a3846efccb`; final `6e484667de2dfb03ef8ca594c7b3b23d0ba6b648`: final is a patch-identical rebase onto main of `63df0870`+`6a64ab64` (range-diff `=`) | `87fb2468793f2039179eb7c2b9d56eb6529b8b01` | [16 success, 2 skipped](https://github.com/STAIxBWLB/agent-hub/actions/runs/42423572778) |
+| [#1304](https://github.com/STAIxBWLB/agent-hub/pull/1304), task 794 | claude (hub review) | `5c3181358680feb2abfe7f5db01820ee89c0c2fc` | `5af8df4df834893654bdee1d1d354da51b220aa5` | [16 success, 2 skipped](https://github.com/STAIxBWLB/agent-hub/actions/runs/42418165231) |
+| [#1298](https://github.com/STAIxBWLB/agent-hub/pull/1298), task 780 | claude (hub review, 1 changes_requested round) | `261845ad8f8ae664363ad6968b08899cf7d28d57` | `4b0d36639d9417b7a810175ed3c9a13d49f429c6` | [16 success, 2 skipped](https://github.com/STAIxBWLB/agent-hub/actions/runs/42418894137) |
+| [#1299](https://github.com/STAIxBWLB/agent-hub/pull/1299), task 789 | claude (hub review) | approved `7b95115d8398604996a91550addd0cb8b2ed5eb1`; final `6d0df595c9be66b30530d651bde6bcaeebcd3824`: final adds two merges of main that resolve conflicts in docs/dogfood.md and docs/operations.md (both sides kept) | `42c1c5010191dd0c0dd19d5fafdd0a730f2d886d` | [16 success, 2 skipped](https://github.com/STAIxBWLB/agent-hub/actions/runs/42417637637) |
+| [#1294](https://github.com/STAIxBWLB/agent-hub/pull/1294), task 784 | claude (hub review) | approved `eb6eaf987208889eac52f1c0560c2a112b0faba0`; final `7bcde8ed2056a8bcd2b20865d2ab5902e269942a`: final adds merges only; `38b212c7` resolves a conflict in src/hub/daemon.ts (keeps both the agy usage lines and the #1285 startup seeds), `7bcde8ed` is clean | `61161ef3b7597d70860d2cdb5ebae5e3f7412e71` | [17 success, 2 skipped](https://github.com/STAIxBWLB/agent-hub/actions/runs/42413064766) |
+| [#1297](https://github.com/STAIxBWLB/agent-hub/pull/1297), task 779 | claude (hub review, 1 changes_requested round) | approved `5b0fc992e8db25a4305c0a38fb556278131b8ac6`; final `47f32f2fc8b78e0c9fb07b8dd3fc6039a99211cb`: final is a patch-identical rebase onto main of `7769d32d`+`5b0fc992` (range-diff `=`) | `5d0bdcaf1acd29d6b76e4e56327a5dd35c825f9f` | [16 success, 2 skipped](https://github.com/STAIxBWLB/agent-hub/actions/runs/42402807512) |
+| [#1286](https://github.com/STAIxBWLB/agent-hub/pull/1286), task 781 | claude (hub review, 1 changes_requested round) | approved `494031e772e00342a845eed4446032a81e55c80f`; final `aa6d6bbd2528e521047eefb5b18dc013b0046d46`: final adds a merge of main that resolves plugins/agent-hub/server.js (generated bundle) | `7860ae334124d630e5ebd613d2e5c32c8b9a6ea1` | [16 success, 2 skipped](https://github.com/STAIxBWLB/agent-hub/actions/runs/42397231097) |
+| [#1303](https://github.com/STAIxBWLB/agent-hub/pull/1303), task 793 | claude (hub review) | `766bb3cec01baeca8250647823498e5b5edd9e62` | `8ab91c6885154524d770d38d8daa8e7202e1fbd9` | [16 success, 2 skipped](https://github.com/STAIxBWLB/agent-hub/actions/runs/42399536629) |
+| [#1308](https://github.com/STAIxBWLB/agent-hub/pull/1308), task 799 | codex (hub review) | `23c28f709fb60afa55e981604fa16418affd4c5e` | `8cfc950acb734ec9ee202deb1098d0af0f42f739` | [16 success, 2 skipped](https://github.com/STAIxBWLB/agent-hub/actions/runs/42408123667) |
+| [#1293](https://github.com/STAIxBWLB/agent-hub/pull/1293), task 797 | codex (hub review) | `c7bbecbddd9332916938937bfb137f2f1015201c` | `51d996e092d1b2789a243a7343d3406d934881c2` | [16 success, 2 skipped](https://github.com/STAIxBWLB/agent-hub/actions/runs/42386183694) |
+| [#1290](https://github.com/STAIxBWLB/agent-hub/pull/1290), task 778 | claude (hub review, 1 changes_requested round) | `1beb9833edc3e8b0ee6b067c06fca3778f59b745` | `26059bd070929b724c330df075bfdcb2c7a311a5` | [16 success, 2 skipped](https://github.com/STAIxBWLB/agent-hub/actions/runs/42390993373) |
+| [#1276](https://github.com/STAIxBWLB/agent-hub/pull/1276), task 777 | claude (hub review, 1 changes_requested round) | `077f351d18feb31a1354f4f4ab35fd939ff2e06c` | `7b58bf74cdced6ec8f6d9d5da8f2cac67bdd0f8a` | [16 success, 2 skipped](https://github.com/STAIxBWLB/agent-hub/actions/runs/42376096936) |
+| [#1296](https://github.com/STAIxBWLB/agent-hub/pull/1296), task 785 | claude (hub review) | `c042ca86dec6e982bcb5320bba767e962d8224e4` | `fcb47f79ac2fd59f6962382a015aad50c86eb4b1` | [17 success, 2 skipped](https://github.com/STAIxBWLB/agent-hub/actions/runs/42385987593) |
+| [#1289](https://github.com/STAIxBWLB/agent-hub/pull/1289), task 782 | claude (hub review) | `eaf4544654601cdf6c165de681a493019a7a0dc6` | `654ca21bd8150db60ee6b073f255bf8008fcf277` | [16 success, 2 skipped](https://github.com/STAIxBWLB/agent-hub/actions/runs/42377488582) |
+| [#1288](https://github.com/STAIxBWLB/agent-hub/pull/1288), task 775 | claude (hub review) | `6067be6040c38ef79b1129d085a5bf755f2323ef` | `ba4d8b12e30bec617c0cf1fb696954828e5964f1` | [16 success, 2 skipped](https://github.com/STAIxBWLB/agent-hub/actions/runs/42376290661) |
+| [#1272](https://github.com/STAIxBWLB/agent-hub/pull/1272), task 764 | claude (hub review) | `40b6374b3e318d50aa12cc4449a6bd84cd1f616f` | `c3413ea1c458ac56bf0794a390f5b28adff436e7` | [16 success, 2 skipped](https://github.com/STAIxBWLB/agent-hub/actions/runs/42376389127) |
+| [#1285](https://github.com/STAIxBWLB/agent-hub/pull/1285), task 770 | claude (hub review) | `5833da3d901d261fbf53d4e6f7275c435070fe62` | `531f47b3416412a8ebc5ef6df0558e879701cac1` | [16 success, 2 skipped](https://github.com/STAIxBWLB/agent-hub/actions/runs/42372063401) |
+| [#1270](https://github.com/STAIxBWLB/agent-hub/pull/1270), task 774 | codex (hub review; earlier one jcode changes_requested round and jcode approvals at `4fcb14c6` and `6230fc3a`) | `0cd432ef63f0983a8b1ecde8dbd578f554480d90` | `5f20b92e5d159dace66894514189dc4c76d7a121` | [17 success, 2 skipped](https://github.com/STAIxBWLB/agent-hub/actions/runs/42372273559) |
+| [#1275](https://github.com/STAIxBWLB/agent-hub/pull/1275), task 767 | claude (hub review) | `f994143d2039c392d71811c3d399224a462e7a9b` | `2fb8c1c07972d21d339ee3f9bdbe98287a4cab97` | [17 success, 2 skipped](https://github.com/STAIxBWLB/agent-hub/actions/runs/42368348563) |
+| [#1267](https://github.com/STAIxBWLB/agent-hub/pull/1267), task 772 | claude (hub review, 2 changes_requested rounds) | `d4d1820a5e742279da8f77ea7429bc7a82861d98` | `a3de35e41ca26614108593b61de5674a960b2b95` | [17 success, 2 skipped](https://github.com/STAIxBWLB/agent-hub/actions/runs/42364266086) |
+| [#1264](https://github.com/STAIxBWLB/agent-hub/pull/1264), task 765 | claude (hub review, 1 changes_requested round) | `60f16c5d54b9e2ef66471b4450453c6785045fc3` | `7f6c03385aca8a5895a2674935b3876d4d15b646` | [17 success, 2 skipped](https://github.com/STAIxBWLB/agent-hub/actions/runs/42360319904) |
+| [#1271](https://github.com/STAIxBWLB/agent-hub/pull/1271), task 776 | jcode review task (class review, no hub_review): reviewed the final head, nothing blocking; Codex connector review no findings; merged after the queued macOS shard passed | `4b94a702b0dcc8e746472107653f8e783fff1469` | `3e27f16c82c57aafc946d9a794e0e0b45c0088b7` | [16 success, 2 skipped](https://github.com/STAIxBWLB/agent-hub/actions/runs/42360647848) |
+| [#1265](https://github.com/STAIxBWLB/agent-hub/pull/1265), task 771 | claude (hub review, 1 changes_requested round) | `eeb24a1706aed33e8be01e2803473e676cfc22da` | `3a0e985bf0dda79907e7d0f09ed2692aacbb6fa4` | [16 success, 2 skipped](https://github.com/STAIxBWLB/agent-hub/actions/runs/42358747977) |
+| [#1269](https://github.com/STAIxBWLB/agent-hub/pull/1269), task 773 | claude (hub review) | `12ed8b3098f14aa65eddf47dc28add1a83b65a7c` | `6df55b13842968f067537a2ee4e9b73c154f1676` | [16 success, 2 skipped](https://github.com/STAIxBWLB/agent-hub/actions/runs/42358633850) |
+| [#1259](https://github.com/STAIxBWLB/agent-hub/pull/1259), task 769 | claude (hub review, 2 changes_requested rounds) | `549cfa052c45bbb9720b3201546581209587143b` | `8e066f20c2809b7700539cd7dd42ef4232f44eae` | [16 success, 2 skipped](https://github.com/STAIxBWLB/agent-hub/actions/runs/42348538629) |
+| [#1258](https://github.com/STAIxBWLB/agent-hub/pull/1258), task 768 | claude (hub review, 1 changes_requested round) | `3a05f6b4f31d7c86a814c52dd67df2541e440082` | `d0db711324178c3ac2d3073e90442b4e9e1c1a54` | [16 success, 2 skipped](https://github.com/STAIxBWLB/agent-hub/actions/runs/42346912434) |
+| [#1256](https://github.com/STAIxBWLB/agent-hub/pull/1256), task 763 | claude (hub review, 1 changes_requested round) | `528a0877aa564d9f4459e5ce62e96a3bf99187d3` | `6f851dc388acc6ca1742741637aa04b51ae3567c` | [16 success, 2 skipped](https://github.com/STAIxBWLB/agent-hub/actions/runs/42344975330) |
+
+Heads that moved after approval:
+
+- Patch-identical rebases onto main, checked with `git range-diff` (every commit `=`): #1305, #1306, #1297. These were stacked PRs rebased after the PR below them was squash-merged.
+- Merge commits only, with no conflict resolution (`git show --cc` empty): #1316, #1302, #1295.
+- Merge commits that resolve conflicts, not re-reviewed on the board: #1286 (plugins/agent-hub/server.js, the generated bundle), #1294 (src/hub/daemon.ts, keeps both the agy usage lines and the #1285 startup seeds), #1299 (docs/dogfood.md and docs/operations.md, both sides kept). Exact-head CI was green on each.
+- #1301: the final head `74b44452` is a patch-identical rebase of `aad7ba51`. That head replays O2 onto approved O1 and adds "discard stale status projection replies", which answered a connector thread. Task 805 filed it as phase B, but the board records no approval at `aad7ba51` or `74b44452`. The conductor reviewed that 12-line delta (`integrations/orca/panel/index.html` plus its race test) after the merge, during this release preparation: a request generation guard discards a status reply that arrives after the selection changed, and clears the stale status on deselect. No defect; the panel is read-only. Exact-head CI was green.
+
+#1339's exact-head `check` run reused the full gate of an identical tree (`ci-reuse.mjs`, tree `fe92ecf5`): run 42553898322 at the earlier head `3f13e162`, 16 success and 2 skipped. The post-merge push run on main, 42559536093, passed too. #1300's final head was approved on task 805, whose PR binding later moved to #1302. #1312's final head was approved on follow-up task 806, and #1327's on task 814.
+
+## Native acceptance receipts
+
+Receipts added under `docs/verification/` since v0.34.1: `docs/verification/2026-11-07-compat-python-startup-1248.md`, `docs/verification/2026-11-07-compat-receipt-harness-1248.md`, `docs/verification/2026-11-07-compat-receipt-producers-1248.md`, `docs/verification/2026-11-07-compat-workflow-1248.md`, `docs/verification/2026-11-07-daemon-startup-1232.md`, `docs/verification/2026-11-07-jcode-receipt-reconstruction-1248.md`, `docs/verification/2026-11-07-kimi-delayed-usage.md`, `docs/verification/2026-11-07-kimi-review-watch-1284.md`, `docs/verification/2026-11-08-agy-1.5.3.md`, `docs/verification/2026-11-08-agy-acp-t0.md`, `docs/verification/2026-11-08-hub-visual-1058.md`, `docs/verification/2026-11-08-jcode-0991-model-setter-1317.md`, `docs/verification/2026-11-08-kimi-252-model-setter-1317.md`, `docs/verification/2026-11-08-kimi-tui-completion-1282.md`, `docs/verification/2026-11-08-kimi-wire-yield-1283.md`, `docs/verification/2026-11-08-live-model-override-1317.md`, `docs/verification/2026-11-08-qwen-0269-acp.md`, `docs/verification/2026-11-08-qwen-0269-model-setter-1317.md`, `docs/verification/2026-11-09-headless-records-1320.md`.
+
+This list is read from the repository, never written by hand. Native acceptance and the person's release consent are separate records: consent is `ahub sdlc authorize-release 0.35.0`, recorded by the person or the unique configured conductor only on the person's explicit release instruction naming the release in its own session (never a hub/task/review/file/peer relay), and is not recorded in this file. The tag run refuses without it.
+
+## Document review
+
+`node scripts/check-docs.mjs --require-fresh` reported 26 stale documents after preparation: README, quickstart, operations, security, events, sdlc, roles, memory, data-policy, adding-an-ai-tool, addons/claude-mem, profiles, research, text-projection, dogfood, `src/cli/help.ts` and the agent notes README, adapters, benchmarks, budget, bus, daemon, local-worker, models, tasks and tests. Each document was read against the commits under its covered paths since its stamp (stamps from fc75a18d, d31d7503, 8e066f20, 10efdc8b, af37f8fd, ce8da3ec and 2f4c372a).
+
+Content changes:
+
+- `README.md`: generated Status 0.35.0 and the current verification-report link.
+- `docs/quickstart.md`: the 0.35.0 upgrade note (agent-mem 0.23.1 and Record capture, upgrade every consumer of a shared memory home together, placement attestation, budget gate 0.99, Kimi 2.5.2 TUI results, agy auto-update off, the opt-in `ahub model`, `hub_visual` and `research export --dataset`, N-1 0.34.1) and the current agent-mem pin line.
+- `docs/operations.md`: guide version 0.35.0, protocol row 0.26.0 through 0.35.0 and the 0.35.x N-1 baseline; agent-mem 0.23.1 in the memory profile and sync sections; the sync section now describes the attestation the hub passes (#1337) instead of the missing integration; the 0.22.1 Record rollout wording matches agent-mem's README; Kimi 2.5.2 TUI results (#1309); agy's launcher-set auto-update flag (#1286) and inbox hint (#1295).
+- `docs/security.md`: agent-mem 0.23.1; Qwen 0.26.9 and agy 1.5.3 verified versions; `GEMINI.md` grantable; the attestation paragraph (#1337); telemetry covers agy transcript tokens, `model_change`, `visual` and the research dataset export; Kimi TUI completion facts (#1309); owner attachment facts (#1311); agent-authored Records (#1339); new sections for person-owned model overrides (#1317), the optional adec decision route (#554) and bounded visual attachments (#1058). The numeric limits were checked against the code.
+- `docs/events.md`: `hub_start.personAttribution`, the agy terminal-Stop `native_turn_end` form, `agent_cli` task attribution, the `agy_transcript` usage source and the per-task person block (#1278).
+- `docs/sdlc.md`: which documents need a manifest entry, and stale stamps reported as PR warnings (#1268).
+- `docs/memory.md`: agent-mem 0.23.1, and the activation preview points at a CLI on the hub's pin with the v0.23.1 README.
+- `docs/adding-an-ai-tool.md`: the builtin-only `modelOverride` definition field (#1321) and the `BasePeer.finalAnswer` path (#1339).
+- `docs/dogfood.md`: the research record v2 row names #1297, #1298 and #1312; the release preparation row no longer says its first use is pending; the staged-upgrade row no longer names a fixed N-1 version.
+- `docs/agent-notes/adapters.md`: the headless Claude `--model` source includes the person's override (#1321); new rule that a driven adapter publishes a final answer through `BasePeer.finalAnswer`, never `onMessage` (#1339).
+- `docs/agent-notes/bus.md`: an invocation answer reaches `onAnswer` with only Record lines stripped (#1339).
+- `docs/agent-notes/local-worker.md`: `protect_instruction_files` names `INSTRUCTION_FILES`, now four files (#1294).
+- `docs/agent-notes/tasks.md`: decide a `hub_remember` result from `rememberOutcome(...).outcome` (#1312); store observers never fail a save (#1339).
+
+Reviewed without content change: `src/cli/help.ts` (`ahub model` and `research export --dataset` were added by their PRs and match `main.ts`), `docs/roles.md`, `docs/data-policy.md`, `docs/addons/claude-mem.md`, `docs/profiles.md`, `docs/research.md`, `docs/text-projection.md`, and the agent notes README, benchmarks, budget, daemon, models and tests. Their PRs either documented themselves or changed nothing they state.
+
+Not added, recorded for a later change: tests.md has no rule for #1262's `useEnvironmentScope()` or #1307's intentional stacked-PR macOS failure; daemon.md's partial list of recovery floors omits `model_overrides` and `visuals`; adapters.md's partial list of builtin-only fields omits `modelOverride`.
+
+The 26 documents are restamped at reviewed content commit `44c523e1e08b`. The 0.35.0 CHANGELOG section was completed in the same commit: 51 commits had touched it only 8 times, so every merged PR now has an entry, and the N-1 statement was added.
+
+## Checks
+
+At committed `a01348539246` on dgx02, with pinned Bun 1.4.2 and frozen root and fixture installs, the following passed:
+
+- `node scripts/check-docs.mjs --require-fresh --committed`: 0 stale documents.
+- `bun x tsc --noEmit`.
+- `bun scripts/build.mjs --check`.
+- `node scripts/check-package.mjs`: 861 files, `@staix/agent-hub@0.35.0`.
+- The published protocol/plugin and broker tests against the retargeted N-1 fixture (published 0.34.1, agent-mem 0.22.1): 28 pass, 0 fail, 175 assertions.
+
+N-1 retarget: npm lists 0.34.1 as the latest 0.34.x patch, with exact agent-mem 0.22.1. The fixture lock was generated with pinned Bun 1.4.2, and its agent-hub and agent-mem integrities equal the registry `dist.integrity` values. Protocol floor fixture 0.25.0 is unchanged.
+
+The full suite on both OSes is the release PR's exact-head hosted CI. The release PR is merged with a merge commit only when that CI is green.
+
+## Known gaps, not blocking
+
+- No installation, running-hub upgrade or real-account inference is claimed here.
+- The N-1 statements about visuals, model overrides, Record capture against a 0.22.1 consumer and rollback with new hub.db tables come from source reading; the N-1 fixture does not exercise them.
+- A live Kimi 2.5.2 TUI launch with the launch-scoped plugin, real Orca and Herdr hosts, and a real shared memory home with mixed agent-mem versions were not run for this report; each PR states its own live-leg status.
+- #1320's Record capture is covered by fixtures; native provider-backed generation and a real shared-home rollout are unrun.

package/docs/verification/2026-11-09-headless-records-1320.md

@@ -0,0 +1,157 @@
+# Headless Record integration (#1320)
+
+This is a source and disposable-fixture receipt, with no live rollout. Agent-mem
+0.23.1 is published and the hub source now imports its public `recordsEnabled`
+accessor. The production path uses the active memory home and execution repository;
+malformed, unavailable or unbound policy disables Records. No real memory home,
+native account, model, provider or person profile was used.
+
+## Published API boundary
+
+Npm metadata identifies exact 0.23.1 at gitHead
+`6b26a529989098aa9f8d5f0b6fa6625cd76e3662`, with integrity
+`sha512-IJdymWpy5kVJgIpqCJyjCWBIFjdfXGS4cXGbdo6IojntvQIIlxspUxmFzARhe7rwDrOpSaDx4yMdnckSfEzBag==`.
+The [public barrel](https://github.com/STAIxBWLB/agent-mem/blob/6b26a529989098aa9f8d5f0b6fa6625cd76e3662/src/index.ts)
+exports `recordsEnabled(base, cwd?)`; its
+[implementation](https://github.com/STAIxBWLB/agent-mem/blob/6b26a529989098aa9f8d5f0b6fa6625cd76e3662/src/memory/config.ts)
+uses the same machine/repository narrowing as native hooks. Either false disables,
+missing configuration enables, and malformed configuration throws. The boolean
+revision binds only this flag; fresh package and hub screens still guard current
+privacy independently. The fixture override is host-only, not a project setting.
+New disposable production-path cases cover both false-inheritance directions,
+malformed machine/repository config and late revocation. These cases passed in
+the production-source run below.
+
+## Verified source boundary
+
+- The package owns `RECORD_INSTRUCTION`, Record grammar and `CaptureStore`.
+- Instruction sampling follows owned input and the busy transition, once per
+  managed headless turn. Claude, isolated reviewers, native-client prompts and
+  steer keep their existing paths.
+- Only complete, current public final answers can append Record rows. Tests
+  cover owner/turn/session/generation/profile/policy drift, PII/private/review/
+  invocation/remote exclusion, monotone unsafe-steering exclusion and current
+  package/hub screening before storage or read selection.
+- Stripping precedes shared envelopes, digest rendering, invocation result
+  handling and console envelope taps. Explicit send tools retain their old
+  route. Invalid lines are stripped too; ordinary text and priority remain.
+- Only successful, cleared `Tasks.note` writes supply generated-note IDs and raw
+  anchors. Manual remember, failed/withheld/private/PII writes, foreign-repository
+  ambiguity and incomplete anchor metadata provide no replacement proof.
+- Replacement preserves unrelated/protected notes and the old byte footprint.
+  Complete known rows can be used from a bounded partial window, with a visible
+  partial marker included in the budget. Restart and LRU eviction preserve old
+  unproved note content; no new persistence or amem schema is introduced.
+
+## Checks
+
+At `00cc1bdeb14b54eea2edaab23a5edc82976f5a7b`, the published 0.23.1 package
+passed strict typecheck, inventory and 141 tests across twelve files in the
+disposable Linux runner. The generated lock changes only the exact amem pin
+and SRI; the value matches npm metadata above. Bun 1.4.2 rebuilt the bundles
+after dependency installation. Committed-artifact freshness and the canonical
+changed-scope gate are the next checks; this run is not a full-suite result.
+
+At `1ac11d3a2ad6d2d889329f959880596e712e8c05`, the committed source passed strict
+typechecking, inventory and 117 tests across ten files in a disposable Linux runner using
+Bun 1.4.2 and agent-mem 0.23.0. Existing memory, recall, intent-library brief and
+corpus concurrency assertions were retained. The initial optional-await dedupe
+regression was corrected in the implementation.
+
+The same run reached inventory checking and identified twelve new feature keys.
+The reviewer's direct ruling clarifies that the blind-80 gate applies to batches
+relabeling existing baseline keys, not new author-added feature literals. The
+informational blind samples scored 64/80 and 67/80. New keys use the call-site
+labels below; the baseline is unchanged.
+
+| New key / call site | Label | Reason |
+| --- | --- | --- |
+| `projectRecordRecall` original length 64 KiB | safety floor | recalled peer text admission |
+| `projectRecordRecall` original byte length 64 KiB | safety floor | recalled peer text admission |
+| `projectRecordRecall` items 32 | operational | host result-list cap |
+| `projectRecordRecall` preferRecordItems 32 | operational | host result-list cap |
+| `kind` regex group 2 | contract | parsed structure position |
+| `Tasks.note` about length below 64 | operational | same label as committed saveNative slice64 |
+| Registry notes 1024 | safety floor | entries originate in another process's calls |
+| Registry anchors 64 | safety floor | peer-supplied references |
+| Registry anchor bytes 512 | safety floor | peer-supplied references |
+| Registry query anchors 1024 | safety floor | derived peer-supplied references |
+| Registry matches 32 | operational | host result-list cap |
+| Registry matching limit below 1 | contract | parameter meaning |
+
+The eight earlier author-added source keys use these same call-site rules:
+
+| New key / call site | Label | Reason |
+| --- | --- | --- |
+| Brief `RECORD_BYTES` 2048 | safety floor | admission bound on model/native-authored stored excerpts before parsing |
+| Brief `RECORD_ROWS` 32 | contract | published package candidate-window shape |
+| Brief `legacyBytes` 2048 | operational | old rendered-block byte budget |
+| Brief `indexLines.reduce` 0 | operational | internal byte-sum initialization (R5) |
+| Brief `maximumLineBytes` 2048 | operational | host rendering budget |
+| Brief `maxBytes ?? 2048` | operational | host rendering default |
+| Capture session digest prefix 16 | contract | stored opaque identity width |
+| Capture turn/status digest prefix 16 | contract | stored opaque identity width |
+
+At `865a017ba5f4601323abfab8159289d434edd68f`, typecheck, inventory and 169 tests
+across thirteen files passed, including the unchanged actual roster scenario.
+Record read revisions now track relevant memory/profile/privacy/flag state rather
+than unrelated configuration reloads. Current privacy screens, capture's stricter
+turn-generation fence and off-roster attachment admission remain independent.
+The frozen lock and generated bundles were stable on the second build.
+
+At `9365c5650ffdecb81f1b4de36218857c67e8c133`, typecheck, inventory and 191 tests
+across fourteen files passed, including the unchanged ACP no-override observer
+case and roster preface case. The final-answer bridge now preserves the current
+`onMessage` chain once, with a host-only scoped marker and stale-owner exclusion.
+The frozen lock and generated bundle were stable on the additional build.
+
+An earlier full-suite attempt also reported one unchanged `route-relay` cooldown
+case. Exact-head and immutable main `cd2080ecf8e54145c34ec8259ec35fa4909c3b7d`
+probes each passed the unchanged original case and a metadata-only instrumented
+copy, with transport failures and the expected cooldown. The original test and
+product routing code remained unchanged. A closed-port reuse path is a candidate,
+not a confirmed cause; a passing focused retry is not full-suite evidence.
+A completed canonical correction run is recorded below.
+
+## Completed canonical evidence
+
+The full run at `978880761507c5e3b2f85e513cf9a79a1055ee9e` completed with
+13,289 pass, 102 skip and four failures across 1,025 files. Three failures were
+source-sliced startup functions receiving a new implicit binding dependency;
+registration was moved to the four verified real factory callers without changing
+permission/admission/bus commit order. The fourth was the static native-branch
+guard following a new generic local alias into unrelated file-wide aliases; a
+Record-specific peer-id name removes that false connection. The original tests,
+ratchet table, resolution depth and assertions remain unchanged.
+
+At `35e1bdfa22bb99c278d6b6b5bde3c486b7bd3334`, strict typecheck, inventory and
+92 targeted tests across six files passed, including the original startup/proxy
+and native-branch tests. Then `scripts/check.sh --changed 978880761507c5e3b2f85e513cf9a79a1055ee9e`
+passed with 3,435 pass, 30 skip and zero failures across 296 files, ending
+`check: OK (changed)` (1,212 seconds including setup). Its typecheck, pinned bundle
+freshness, tarball, facts and daemon-leak checks passed. This is a completed full
+attempt plus a passing verification of its corrected delta, not a claim of a
+new zero-failure full run. Final-head hosted full CI remains a merge gate.
+
+## Synthetic byte measurements
+
+| Projection | Before UTF-8 bytes | After UTF-8 bytes |
+| --- | ---: | ---: |
+| Shared final-answer body | 60 | 5 |
+| Rendered digest | 155 | 100 |
+| Proven-overlap brief lines | 261 | 178 |
+| Rendered recall block | 523 | 387 |
+
+These are actual callback/rendered values from the deterministic fixtures.
+Recall includes the mixed-source header identifying capture Records as uncurated;
+its change contributes to the byte difference. These are
+not production averages or model-quality measurements. The recall fixture uses
+the existing generated-title ceiling of 120 characters. The same fixture retains
+the unrelated contract and coverage/trailing notices, calls context injection once,
+and verifies conservative fallback after the registry is cleared.
+
+## Remaining gates
+
+- Final-head hosted CI and review.
+- Native/provider-backed Record generation and real-home/coordinated-upgrade
+  behavior remain unrun; fixture success does not claim those observations.

package/docs/verification/claude-permission-transport-native.py

@@ -14,12 +14,15 @@ def mcp_name(value):
 parser = argparse.ArgumentParser()
 parser.add_argument('output')
 parser.add_argument('--claude', action='append', required=True)
+parser.add_argument('--runtime-path', help='Explicit isolated runtime PATH; omitted preserves the original fixed PATH')
+parser.add_argument('--expected-version', help='Require this exact candidate version; omitted preserves the original receipt procedure')
 parser.add_argument('--tool', choices=('Write', 'Bash'), default='Write')
 parser.add_argument('--rewrite-bash', action='store_true', help='Bash only: two allow/deny cases proving native updatedInput command replacement')
 parser.add_argument('--server-name', type=mcp_name, default='fixture')
 parser.add_argument('--permission-tool', type=mcp_name, default='approve')
 parser.add_argument('--require-tool-use-id', action='store_true', help='Advertise the three required production permission fields and reject extra properties')
 args = parser.parse_args()
+runtime_path = args.runtime_path if args.runtime_path is not None else '/usr/bin:/bin'
 if args.rewrite_bash and args.tool != 'Bash': parser.error('--rewrite-bash requires --tool Bash')
 ROOT = pathlib.Path(args.output).resolve()
 ROOT.mkdir(mode=0o700, parents=False, exist_ok=False)
@@ -144,9 +147,10 @@ for index, raw in enumerate(args.claude):
     digest = sha(binary)
     # The index keeps two binaries with the same basename or the same version in separate directories.
     ident = ROOT / ('identity-%d-%s' % (index, binary.name)); ident.mkdir()
-    v = subprocess.run([str(binary), '--version'], env={'HOME': str(ident), 'CLAUDE_CONFIG_DIR': str(ident / 'config'), 'PATH': '/usr/bin:/bin'}, capture_output=True, text=True, timeout=10)
+    v = subprocess.run([str(binary), '--version'], env={'HOME': str(ident), 'CLAUDE_CONFIG_DIR': str(ident / 'config'), 'PATH': runtime_path}, capture_output=True, text=True, timeout=10)
     assert v.returncode == 0, v
     version = v.stdout.strip().split()[0]
+    if args.expected_version is not None: assert version == args.expected_version, 'native version differs from requested candidate'
     for case, (settings, want_exit, want_calls, want_file, want_error, want_stop) in selected_cases.items():
         d = ROOT / ('%d-%s-%s' % (index, version, case)); d.mkdir()
         home = d / 'home'; home.mkdir(); work = d / 'work'; work.mkdir(); work = work.resolve()
@@ -160,7 +164,7 @@ for index, raw in enumerate(args.claude):
             tool_input = {'file_path': str(target), 'content': 'probe'} if args.tool == 'Write' else {'command': 'bun test test/ci-watch.test.ts' if args.rewrite_bash else harmless}
             settings = dict(settings)
             if args.tool == 'Bash': settings['permissions'] = {'ask': ['Bash']}
-            fixture_path = '/usr/bin:/bin'
+            fixture_path = runtime_path
             original_marker = work / 'original-command-ran'
             if args.rewrite_bash:
                 (work / 'test').mkdir()
@@ -190,7 +194,10 @@ for index, raw in enumerate(args.claude):
                 native.wait(timeout=25)
             except subprocess.TimeoutExpired:
                 stopped_externally = True
-                os.killpg(native.pid, signal.SIGKILL); native.wait(timeout=5)
+                if native.poll() is None:
+                    try: os.killpg(native.pid, signal.SIGKILL)
+                    except ProcessLookupError: pass
+                native.wait(timeout=5)
             elapsed = round(time.monotonic() - started, 3)
             calls = rows(d / 'mcp.jsonl')
             frames = rows(d / 'stdout')

package/docs/verification/claude-shell-wrapper-native.py

@@ -1,7 +1,7 @@
 # Model-free native receipt. Usage: python3 this.py OUTPUT --bun /absolute/bun --claude /absolute/claude [--claude ...]
 import argparse, hashlib, http.server, json, os, pathlib, select, shlex, signal, subprocess, sys, threading
-parser=argparse.ArgumentParser(); parser.add_argument('output'); parser.add_argument('--bun',required=True); parser.add_argument('--claude',action='append',required=True)
-args=parser.parse_args(); ROOT=pathlib.Path(args.output).resolve(); ROOT.mkdir(mode=0o700,parents=False,exist_ok=False)
+parser=argparse.ArgumentParser(); parser.add_argument('output'); parser.add_argument('--bun',required=True); parser.add_argument('--claude',action='append',required=True); parser.add_argument('--runtime-path',help='Explicit isolated runtime PATH; omitted preserves original native and host paths'); parser.add_argument('--expected-version',help='Require an exact candidate version; omitted retains the original version controls')
+args=parser.parse_args(); runtime_path=args.runtime_path if args.runtime_path is not None else '/usr/bin:/bin'; host_path=args.runtime_path if args.runtime_path is not None else '/opt/homebrew/bin:/usr/bin:/bin'; ROOT=pathlib.Path(args.output).resolve(); ROOT.mkdir(mode=0o700,parents=False,exist_ok=False)
 HOST=pathlib.Path(__file__).with_name('claude-shell-wrapper-host.ts').resolve()
 MCP="import sys,json,os,time\nfor line in sys.stdin:\n try: q=json.loads(line)\n except: continue\n method=q.get('method'); rid=q.get('id')\n if rid is None: continue\n if method=='initialize': r={'protocolVersion':'2024-11-05','capabilities':{'tools':{}},'serverInfo':{'name':'fixture','version':'1'}}\n elif method=='tools/list': r={'tools':[{'name':'approve','description':'Person approval fixture','inputSchema':{'type':'object','properties':{'tool_name':{'type':'string'},'input':{'type':'object'},'tool_use_id':{'type':'string'}},'required':['tool_name','input','tool_use_id'],'additionalProperties':False}}]}\n elif method=='tools/call':\n  mode=os.environ['CASE']; args=q.get('params',{}).get('arguments',{})\n  if mode=='timeout': time.sleep(60)\n  if mode=='approval-timeout': time.sleep(.1)\n  if mode=='disconnect': sys.exit(1)\n  if mode=='tool-error':\n   print(json.dumps({'jsonrpc':'2.0','id':rid,'error':{'code':-32000,'message':'fixture hub unavailable'}}),flush=True); continue\n  if mode in ('deny','hook-failure','approval-timeout'): value={'behavior':'deny','message':'no person answered' if mode=='approval-timeout' else 'fixture denied'}\n  else:\n   updated=args.get('input',{})\n   if mode=='normalized' and updated.get('description') in ('probe1','probe2'): updated={'command':os.environ['NORMALIZED'],'description':'host-bound fixture'}\n   value={'behavior':'allow','updatedInput':updated}\n  with open(os.environ['RECEIPT'],'a') as f: print(json.dumps({'arguments':args,'response':value}),file=f)\n  r={'content':[{'type':'text','text':json.dumps(value)}]}\n else: r={}\n print(json.dumps({'jsonrpc':'2.0','id':rid,'result':r}),flush=True)\n"
 (ROOT/'mcp.py').write_text(MCP)
@@ -45,7 +45,7 @@ def stop(process):
     try: os.killpg(process.pid,signal.SIGKILL)
     except ProcessLookupError: pass
    process.wait(timeout=5)
-  return process.returncode==0
+  return process.returncode==0 and empty_group(process.pid)
  except (OSError,subprocess.TimeoutExpired):return False
 
 def empty_group(pid):
@@ -67,8 +67,8 @@ def sha(file):
 results=[]
 for raw_binary in args.claude:
  binary=pathlib.Path(raw_binary).resolve(); identity=ROOT/('identity-'+binary.name); identity.mkdir()
- version=subprocess.run([str(binary),'--version'],env={'HOME':str(identity),'CLAUDE_CONFIG_DIR':str(identity/'config'),'PATH':'/usr/bin:/bin'},capture_output=True,text=True,timeout=10)
- assert version.returncode==0 and version.stdout.strip().split()[0] in ('2.1.309','2.1.310','2.1.314','2.1.316','2.1.318','2.1.319'),(version.returncode,version.stdout)
+ version=subprocess.run([str(binary),'--version'],env={'HOME':str(identity),'CLAUDE_CONFIG_DIR':str(identity/'config'),'PATH':runtime_path},capture_output=True,text=True,timeout=10)
+ assert version.returncode==0 and (version.stdout.strip().split()[0] == args.expected_version if args.expected_version is not None else version.stdout.strip().split()[0] in ('2.1.309','2.1.310','2.1.314','2.1.316','2.1.318','2.1.319')),(version.returncode,version.stdout)
  label=version.stdout.strip().split()[0]; digest=sha(binary)
  for mode in ('context','normalized'):
   d=ROOT/(label+'-'+mode); d.mkdir(); home=d/'home';home.mkdir(); work=d/"work 'quoted'";work.mkdir();(work/'sub').mkdir()
@@ -81,7 +81,7 @@ for raw_binary in args.claude:
    rewritten=''
    if mode=='normalized':
     fixture=d/'host.json';fixture.write_text(json.dumps({'root':str(work),'executable':str(executable)}))
-    helper=subprocess.Popen([str(pathlib.Path(args.bun).resolve()),str(HOST),str(fixture)],env={'HOME':str(home),'PATH':'/opt/homebrew/bin:/usr/bin:/bin','LANG':'C','TERM':'dumb'},stdin=subprocess.PIPE,stdout=subprocess.PIPE,stderr=open(d/'host.stderr','w'),text=True,start_new_session=True)
+    helper=subprocess.Popen([str(pathlib.Path(args.bun).resolve()),str(HOST),str(fixture)],env={'HOME':str(home),'PATH':host_path,'LANG':'C','TERM':'dumb'},stdin=subprocess.PIPE,stdout=subprocess.PIPE,stderr=open(d/'host.stderr','w'),text=True,start_new_session=True)
     assert select.select([helper.stdout],[],[],10)[0],'host fixture handshake timeout'
     reply=json.loads(helper.stdout.readline());rewritten=reply['command'];assert isinstance(rewritten,str) and rewritten
    commands=['cd sub && pwd','pwd']+(['pwd'] if mode=='normalized' else [])
@@ -89,7 +89,7 @@ for raw_binary in args.claude:
    threading.Thread(target=srv.serve_forever,daemon=True).start()
    config={'mcpServers':{'fixture':{'command':'/usr/bin/python3','args':[str(ROOT/'mcp.py')],'env':{'CASE':mode,'RECEIPT':str(d/'mcp.jsonl'),'NORMALIZED':rewritten}}}}
    (d/'mcp.json').write_text(json.dumps(config));(d/'settings.json').write_text(json.dumps({'permissions':{'ask':['Bash']}}))
-   native_env={'HOME':str(home),'CLAUDE_CONFIG_DIR':str(home/'config'),'PATH':'/usr/bin:/bin','ANTHROPIC_BASE_URL':'http://127.0.0.1:'+str(srv.server_port),'ANTHROPIC_API_KEY':'synthetic-probe-not-a-credential','CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC':'1','DISABLE_AUTOUPDATER':'1','GIT_DIR':str(d/'poison-git'),'RIPGREP_CONFIG_PATH':str(d/'poison-rg')}
+   native_env={'HOME':str(home),'CLAUDE_CONFIG_DIR':str(home/'config'),'PATH':runtime_path,'ANTHROPIC_BASE_URL':'http://127.0.0.1:'+str(srv.server_port),'ANTHROPIC_API_KEY':'synthetic-probe-not-a-credential','CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC':'1','DISABLE_AUTOUPDATER':'1','GIT_DIR':str(d/'poison-git'),'RIPGREP_CONFIG_PATH':str(d/'poison-rg')}
    argv=[str(binary),'-p','--output-format','stream-json','--verbose','--strict-mcp-config','--mcp-config',str(d/'mcp.json'),'--setting-sources','','--settings',str(d/'settings.json'),'--permission-mode','default','--permission-prompts','host','--permission-prompt-tool','mcp__fixture__approve','--model','claude-sonnet-4-5','Run the fixture commands.']
    native=subprocess.Popen(argv,cwd=work,env=native_env,stdout=open(d/'stdout','w'),stderr=open(d/'stderr','w'),start_new_session=True)
    native.wait(timeout=25);assert native.returncode==0,(native.returncode,(d/'stderr').read_text())
@@ -115,7 +115,7 @@ for raw_binary in args.claude:
    else:
     observed=json.loads(output(1));assert observed['marker']=='HOST_EXECUTABLE' and observed['cwd']==str(work) and observed['executable']==str(executable.resolve()),observed
     assert observed['nativeVars']=={'GIT_DIR':None,'RIPGREP_CONFIG_PATH':None},observed
-    assert observed['peer']=='claude-fixture' and observed['term']=='dumb' and observed['home']==str(home) and observed['path']=='/opt/homebrew/bin:/usr/bin:/bin',observed
+    assert observed['peer']=='claude-fixture' and observed['term']=='dumb' and observed['home']==str(home) and observed['path']==host_path,observed
     assert observed['tmpdir'] and 'ahub-shell-' in observed['tmpdir'] and str(d) not in observed['tmpdir'],observed
     replay_tool,replay=frames['toolu_probe_2'];assert replay.get('is_error') is True and 'host shell execution refused' in json.dumps(replay_tool),frames['toolu_probe_2']
     assert counter.read_text()=='1',counter.read_text()