@staix/agent-hub 0.7.6 → 0.7.8

package/CHANGELOG.md

@@ -1,7 +1,26 @@
 # Changelog
 
+Issue and pull request numbers in the entries for 0.7.7 and earlier refer to the previous repository, archived on 2026-09-30 when this repository's history was rewritten; the one exception is the open smoke-check issue, formerly #12, which moved here as #1. Numbers in newer entries refer to this repository.
+
 ## Unreleased
 
+## 0.7.8
+
+- README, the operations guide and the upgrade-recovery spec no longer describe protocol 10 and the queue commands as unreleased (#9).
+- Codex answers a digest to every sender in it, and a sender steered into its turn, like the other adapters; an answer to a condensed digest no longer goes to the reserved `digest` sender and reaches no peer, also when a steer joined the turn (the bus now maps `digest` for any adapter). A TUI that detaches mid-turn and comes back no longer answers the old turn's senders (#3).
+- A waiting approval raises a macOS notification naming the peer and, for Kimi, the tool (never the payload); the approval timeout is configurable as `approvals.timeout_s`, and an unanswered request leaves a console and log line (#5).
+- Claims: a self-claim without a class is filed as `implement` when no model can name one; the earlier owner of an overlapping task hears of it with its next message; an owner offline past `tasks.release_after_min` (default 30) loses its open tasks to a peer that can take them (#6).
+- A class can carry a completion check (`checks.<class>` in a `.agenthub/config.json` git confirms nobody committed; outside a repository none runs): marking such a task done runs it, sends the task to review with the result on success, and keeps it with its owner with the failure otherwise. A hub stop interrupts a check without a verdict (#7).
+- `scripts/overlaps.ts` counts the claim overlap warnings in hub logs per week and names the task pairs, for the two-week measurement that decides whether per-task worktrees are built. The procedure and the numbers go in `docs/smoke.md` (#8).
+- Releases publish to npm through trusted publishing (OIDC) instead of a stored token, and the workflows use the Node 24 releases of `actions/checkout` and `actions/setup-node` (#4).
+
+## 0.7.7
+
+- `ahub setup` without a terminal and without `--yes` prints the step it would take and exits non-zero instead of waiting forever at its prompt, as `restart` and `upgrade` already did. A piped answer (`yes | ahub setup`) is no longer read: use `--yes` (#73).
+- The smoke ledger no longer names the internal gateway's address, and the package check fails when any published file contains a private IPv4 address, naming only the file and line (#74).
+- Kimi's requests for the hub's own tools (`hub_send`, the task tools) are approved once without a console prompt, as Codex's already were, so a Kimi nobody watches can claim work and record notes. Kimi 2.1.1 approval prompts for other tools show the command again: the payload falls back to the streamed argument JSON when the request carries none. A payload too long to show whole is marked as cut and no longer offers a session-wide grant, for every ACP agent (#72).
+- The operations guide's upgrade section names each supported source range (0.6.x, 0.7.x before the target) and the unsupported one (0.5.x and earlier): run the target release's coordinator through `bunx`. Dry-runs from running 0.6.4 and 0.7.5 hubs are recorded (#75).
+
 ## 0.7.6
 
 - Shared notes reach the agents working now: `hub_remember` has a `fail` kind for approaches that do not work, and every saved note rides on the other peers' next delivery (newest 10, one line each) instead of waiting for their next session. A note that matches a PII pattern is refused. A preface returned by a failed delivery no longer overwrites one created meanwhile (#68).
@@ -84,7 +103,7 @@
 ## 0.4.1 (included in 0.5.0)
 
 - Synchronize the daemon digest integration fixture without changing batching semantics or weakening digest/FYI assertions (#15).
-- Reconcile completed live smoke and npm publication evidence; infrastructure-dependent checks remain tracked in #12.
+- Reconcile completed live smoke and npm publication evidence; infrastructure-dependent checks remain tracked in #1 (formerly #12).
 
 ## 0.4.0
 

package/README.md

@@ -4,7 +4,7 @@ Native multi-agent hub for one developer's machine: Claude Code, Codex, Kimi Cod
 hub-owned local-LLM worker collaborate as peers in independent project directories, with
 task-aware model routing (Switchyard) in front of a self-hosted gateway (OmniRoute).
 
-Status: 0.7.6, control protocol 10. Durable delivery records distinguish queued
+Status: 0.7.8, control protocol 10. Durable delivery records distinguish queued
 work from uncertain execution. The [smoke checklist](docs/smoke.md) records
 verified paths and remaining prerequisites.
 
@@ -28,7 +28,7 @@ cd <your project> && ahub init && ahub up && ahub tail
 Or install the same version from GitHub:
 
 ```bash
-bun add -g github:STAIxBWLB/agent-hub#v0.7.6 && ahub setup
+bun add -g github:STAIxBWLB/agent-hub#v0.7.8 && ahub setup
 ```
 
 The installed commands remain `ahub` and `agent-hub`.
@@ -113,8 +113,9 @@ A project has one managed Pi session owner. Mode changes require the agent to
 settle and preserve the session file. Before the first generation, a live source
 verified to be empty can instead retain its exact session ID without a file.
 Missing history from a nonempty session blocks handover. Protocol 9 adds Pi
-recovery metadata. Protocol 10 is the 0.7.0 target for durable delivery
-receipts and conservative queue recovery; it is pending live verification.
+recovery metadata. Protocol 10, released in 0.7.0, adds durable delivery
+receipts and conservative queue recovery; it is verified live (see the
+[smoke checklist](docs/smoke.md)).
 Older protocol hubs still require their matching CLI and an attended bootstrap.
 
 ## Runtime

package/docs/operations.md

@@ -1,6 +1,6 @@
 # Operations guide
 
-This guide describes ahub 0.7.6 and control protocol 10. Live verification
+This guide describes ahub 0.7.8 and control protocol 10. Live verification
 results and remaining prerequisites are recorded separately in [the smoke ledger](smoke.md).
 
 ## Install and start
@@ -58,11 +58,32 @@ ahub review <task-id> approved "verified against the requested behavior"
 ahub review <task-id> changes_requested "describe the required correction"
 ```
 
+A class can carry a completion check in `.agenthub/config.json`, for example
+`"checks": { "implement": "scripts/check.sh", "timeout_s": 600 }`. When the owner
+marks such a task done, the tool answers at once, the hub runs the command in the
+project root (one at a time; what it left in its process group is killed when it
+exits, at the timeout or on shutdown), and then either
+sends the task to review with the command, exit code and output tail, or keeps it
+with its owner and tells it what failed. The hub runs `checks` only when git
+confirms that nobody committed `.agenthub/config.json`: a committed file must not
+choose commands the hub runs, and outside a git repository it runs none. Keys that
+are not task classes are ignored with a log line. A hub stopped mid-check leaves
+the task in progress (`check interrupted`); the owner marks it done again.
+
 A task reaching `approved` is a board transition. It is not proof that an
 external side effect happened unless the task's refs and a live readback show
 that effect. The hub can reassign after repeated review changes according to
 the routing configuration.
 
+An agent can claim work nobody assigned it by proposing a task with itself as
+owner; without a class, and with no model to name one, the claim is filed as
+`implement`. When a task's paths overlap another owner's open task, the newcomer
+is told to settle it and the earlier owner gets one line with its next message,
+at no turn of its own. An owner offline longer than `tasks.release_after_min`
+(default 30, `0` turns it off) in `.agenthub/config.json` loses its open tasks
+to a peer routing can give them to; with nobody to take them they stay, and a
+paused peer or a hub in a recovery operation is left alone.
+
 Use targeted messages for coordination:
 
 ```bash
@@ -86,7 +107,15 @@ ahub permit <request-id> allow
 ```
 
 Use the exact option shown by `ahub tail`; do not approve an unresolved or
-unexpected request. `ahub pause <peer>` holds delivery and `ahub resume
+unexpected request. On macOS a waiting request also raises a desktop
+notification that names the peer and, for Kimi, the tool, never what it would
+run. An unanswered request is cancelled after `approvals.timeout_s` (default
+120, 30 to 3600) in `.agenthub/config.json`, and the console and log say so.
+Set `approvals.notify` to `false` to turn notifications off; a hub started
+without a project config file raises none. While Kimi waits for an answer its
+turn is kept alive, so a timeout longer than the inactivity watchdog does not
+cancel it.
+`ahub pause <peer>` holds delivery and `ahub resume
 <peer>` releases a manual pause. Budget pauses are distinct:
 
 ```bash
@@ -114,11 +143,10 @@ ahub queue show <delivery-id>
 ahub queue resolve <delivery-id> --action completed|retry|discard --reason "<text>"
 ```
 
-These queue commands are part of 0.7.0 and are not available in the released
-0.6.4 CLI. Until protocol 10 is installed, use `ahub status`, `ahub tail`,
-and the task board. A known offline recipient may be queued explicitly once
-the 0.7.0 journal is active; broadcast and automatic assignment still require
-an attached peer.
+These queue commands ship with protocol 10 (0.7.0 and later), where a known
+offline recipient may also be queued explicitly; broadcast and automatic
+assignment still require an attached peer. A hub still on protocol 9 (0.6.x)
+has only `ahub status`, `ahub tail` and the task board.
 
 Resolution requires the current observed revision. A retry closes the old
 record and creates one linked attempt. Stale or conflicting resolutions fail.
@@ -178,31 +206,50 @@ Rows without a live process are stale registrations; forget them with
 
 ## Upgrade and crash recovery
 
-For an upgrade from 0.6.4 (protocol 9) or 0.7.0, use the patched coordinator without
-replacing the global CLI prematurely. Run from the project directory:
+Upgrade running projects with the target release's own coordinator. It accepts
+a running source on control protocol 9 (0.6.x) or 10 (0.7.0 and later) and only
+a target on its own protocol, so the target's coordinator fits every supported
+source and carries every recovery fix released up to it. Protocol 8 and older
+(0.5.x and earlier) are refused as `manual-bootstrap-required`. Run from the
+project directory, without replacing the global CLI first:
 
 ```bash
-bunx --package @staix/agent-hub@0.7.6 ahub upgrade --to 0.7.6 --dry-run
-bunx --package @staix/agent-hub@0.7.6 ahub upgrade --to 0.7.6 --yes
+bunx --package @staix/agent-hub@0.7.8 ahub upgrade --to 0.7.8 --dry-run
+bunx --package @staix/agent-hub@0.7.8 ahub upgrade --to 0.7.8 --yes
 ```
 
+| Running now | Coordinator to use |
+| --- | --- |
+| 0.6.x (protocol 9) | the target's, through `bunx` as above |
+| 0.7.0 up to the release before the target (protocol 10) | the target's, through `bunx` as above |
+| any supported source, with the installed CLI already at the target | `ahub upgrade` below, which is the same coordinator |
+| 0.5.x or earlier (protocol 8 and older) | not supported: bootstrap by hand with the matching CLI |
+
+Do not use an older installed CLI as the coordinator. A 0.6.x CLI cannot target
+protocol 10: its plan does not check the target's protocol, so the dry-run shows
+no blocker, and `--yes` stops at staging ("target protocol requires a newer
+coordinator") with an operation left to clear by `ahub recovery abort <id>`. An
+older 0.7.x CLI may lack recovery fixes released after it. The
+[smoke ledger](smoke.md) records dry-runs from real 0.6.4 and 0.7.5 hubs (issue
+#75); an applied upgrade was last proven with the 0.7.0 coordinator.
+
 The coordinator verifies and retains the exact target package, preserves its
 own source, and promotes the global CLI only after restored projects pass
-readback. Do not use the old protocol-9 coordinator to target protocol 10.
+readback.
 
-Once the installed CLI is 0.7.6, review the current project or all registered
+Once the installed CLI is 0.7.8, review the current project or all registered
 projects first:
 
 ```bash
 ahub restart --dry-run
-ahub upgrade --to 0.7.6 --dry-run
+ahub upgrade --to 0.7.8 --dry-run
 ```
 
 Apply only after reviewing the plan:
 
 ```bash
 ahub restart --yes
-ahub upgrade --to 0.7.6 --yes
+ahub upgrade --to 0.7.8 --yes
 ahub recovery status <operation-id>
 ahub recovery resume <operation-id>
 ahub recovery abort <operation-id>
@@ -245,7 +292,7 @@ peers and therefore did not show that backlog. No messages were deleted. The
 0.7.1 attended cutover and production readback verified queue visibility and
 completion receipts; see the final section of the smoke checklist.
 
-Issue [#12](https://github.com/STAIxBWLB/agent-hub/issues/12) remains open for
+Issue [#1](https://github.com/STAIxBWLB/agent-hub/issues/1) remains open for
 off-campus Access credentials and a natural near-limit budget pause. Tests,
 synthetic approvals, and an authenticated internal network do not close those
 prerequisites. Adapter acceptance is not task completion, and package

package/docs/quickstart.md

@@ -17,7 +17,7 @@ ahub setup                                # installs the Claude Code channel plu
 Or use the matching GitHub release:
 
 ```bash
-bun add -g github:STAIxBWLB/agent-hub#v0.7.6
+bun add -g github:STAIxBWLB/agent-hub#v0.7.8
 ahub setup
 ```
 

package/docs/security.md

@@ -6,7 +6,8 @@ agent-hub connects agents that can each run commands. This page says what the hu
 
 - **Other agents' text is untrusted.** Every message that crosses from one peer to another is framed as untrusted input (a channel tag with `meta.source` for Claude, a fixed header line plus a standing instruction for the others). A message body cannot forge the hub's own headers: such lines are quoted (`sanitize`). Replies inherit a hop count capped at 3, so agents cannot ping-pong forever; neither a digest nor a steer can reset it.
 - **The control link is loopback plus a secret.** The daemon and the Codex proxy bind 127.0.0.1 only. The control WebSocket requires a per-run token (`.agenthub/state/control-token`, mode 600), and both servers refuse any request that carries an `Origin` header: any web page can open a WebSocket to localhost, and browsers always send `Origin`. External clients cannot claim the console user's id or a hub-managed peer's id.
-- **Permission prompts stay on.** `ahub claude` and `ahub codex` add nothing that weakens the agents' own prompts. Kimi's and `local`'s permission requests are relayed to the console and cancelled after 120 s of silence. `--unattended` turns prompts off, says so loudly, and is never the default.
+- **Permission prompts stay on.** `ahub claude` and `ahub codex` add nothing that weakens the agents' own prompts. Kimi's and `local`'s permission requests are relayed to the console and cancelled after `approvals.timeout_s` (default 120 s) of silence; the macOS notification for a waiting request carries the peer and the tool name only. The one exception is the hub's own tools (`hub_send` and the task tools, matched by exact name): Kimi's requests for them are approved once without a prompt and logged by name, the same trust Codex gets through `approval_mode` in the hub's config. They touch no file and run no process, and every call passes the hub's own checks. The match relies on the agent putting the tool name in the request's `title`, as Kimi does; an ACP agent that titles calls with model-written text must not be configured as `kimi_cmd`. A payload longer than the console shows is marked as cut and never offers a session-wide grant. `--unattended` turns prompts off, says so loudly, and is never the default.
+- **Completion checks run only from a config nobody committed.** A command in `checks` runs as you, outside the local worker's sandbox, like a git hook, when a task of that class is marked done. The hub runs `checks` only when git confirms that `.agenthub/config.json` is not committed, in any letter case, and that `.agenthub` is not a committed symlink or submodule; without a repository, or when git fails, it runs none. So a cloned repository cannot choose a check. Nothing in `routing.toml` or in task text is ever run. The launch commands in the same file (`kimi_cmd`, `codex_bin`, `pi.cmd`) have no such guard: start a hub only in a checkout whose `.agenthub/config.json` you trust.
 - **The local worker is boxed in.** Paths are resolved through symlinks and must stay inside the project; a secrets denylist (`.env*`, keys, credential files, the hub's own state) applies to its file tools, its git arguments and its memory capture alike; `.git` and `.agenthub` are not writable. Writes, edits, shell commands and mutating git wait for approval, and the approver sees what will be written or run, with control characters escaped. Everything it executes runs under the macOS sandbox, attended or not: no writes outside the project, its git dir and temp; the home directory is unreadable except toolchains; no `.git/hooks` or `.git/config` writes; no network, loopback included. Without the sandbox there is no `bash` tool.
 - **PII has an enforced path.** A task matching `signals.pii_patterns` goes to `local` or to nobody; its text is absent from other peers' envelopes, the console stream, the log and the board listing; the console user reviews it; `local` answers such a turn to the console only, keeps it out of its history, refuses it when the only gateway is off campus, and may not save notes or spin off tasks during it. Nothing about it is sent to claude-mem, whose observer is a cloud model.
 - **Secrets stay where they are read.** The gateway key and Cloudflare Access values are read inside the gateway client and go only into request headers: never into logs, errors, envelopes, tool output, memory, or the generated Switchyard config (the key travels by environment variable name). Subscription logins of Claude, Codex and Kimi are never proxied or pooled.

package/docs/smoke.md

@@ -57,7 +57,7 @@ and the local worker:
 - Task #1 reached `approved` with its file written. The local worker served
   `sy/coding` through the switchyard on 127.0.0.1:4813
   (`vllm/deepseek-ai/DeepSeek-V4-Flash-0731`), and Pi's `dgx/coding` traffic
-  went through the gateway (omniroute 172.16.229.33:20128) as before.
+  went through the internal gateway as before.
 - Kimi stayed healthy through the run (KIMI-IDLE-AGAIN, KIMI-FINAL-MARKER
   markers, zero queued at the end). The disposable hub and manager were
   stopped after recording.
@@ -170,7 +170,7 @@ Verified on 2026-09-20, without upgrading the developer's running hubs:
 Still pending: a real Orca smoke with native Codex/Claude sessions after an
 attended protocol-8 bootstrap; actual registry package/plugin upgrade; production
 rollout. Fake terminal receipts do not establish native conversation restoration.
-Issue #12's Access and natural-quota prerequisites remain unchanged.
+Issue #1's Access and natural-quota prerequisites remain unchanged.
 
 ## Install
 
@@ -333,9 +333,9 @@ No production task or source file was used as a test target.
 | Claude task proposal and review tools | pass | The actual plugin `hub_task_propose` created scratch task #1, `ISSUE7-REVIEW-FLOW`, at 12:44:20 UTC, attributed to `claude`. The first assignment remained empty because the Codex peer had been detached; proposal success is separate from handoff success. Claude subsequently issued two actual `hub_review` calls with `changes_requested` at 12:47:50 and 12:47:59 UTC. |
 | Real Codex TUI queue and MCP tools | pass | With Codex 0.155.1 TUI attached, a typed user turn ran `sleep 30`; the status message showed `busy queued 1`, appeared in the transcript only after the user turn completed, and invoked the actual `hub_task_list` before replying `QUEUE-DELIVERED`. |
 | Real Codex TUI steer | pass | In a second typed user turn, the TUI prompt explicitly authorized a console marker update while `sleep 20` ran. An important message arrived at 12:48:15 UTC; queue remained 0; the same turn ended at 12:48:39 UTC with `STEER-VERIFIED` at hop 1. The first probe delivered its steer but the model retained the original user instruction, so that attempt was not counted as behavioral success. |
-| Unassisted Claude proposal -> Codex completion -> Claude review and escalation | fail, [#11](https://github.com/STAIxBWLB/agent-hub/issues/11) | Task #1 was delivered to Codex at 12:47:05 UTC; it replied `Task #1 noted; no action taken on the hub reference message.` and left the task proposed. Generated instructions classify every hub item as reference-only memory. After a corrective user prompt in the TUI, board history recorded Codex accepted/done, Claude changes_requested, Codex done, Claude changes_requested, and hub escalation to Kimi. Kimi then accepted/done through its real tools, and Claude approved the task. That assisted success does not erase the default-flow failure. |
-| Off-campus Cloudflare Access headers | blocked, [#12](https://github.com/STAIxBWLB/agent-hub/issues/12) | Internal gateway reachable; both Access credential-file settings empty; unauthenticated public models probe HTTP 403. Needs authorized Access credentials and an off-campus network. VPN was not disconnected. |
-| Natural Codex budget pause with TUI attached | blocked, [#12](https://github.com/STAIxBWLB/agent-hub/issues/12) | Actual TUI-connected weekly reading was approximately 12%, below the gate. No manual budget reading was injected. Needs a naturally near-limit account; parser and manual-injection tests are not this live leg. |
+| Unassisted Claude proposal -> Codex completion -> Claude review and escalation | fail, #11 (previous repository) | Task #1 was delivered to Codex at 12:47:05 UTC; it replied `Task #1 noted; no action taken on the hub reference message.` and left the task proposed. Generated instructions classify every hub item as reference-only memory. After a corrective user prompt in the TUI, board history recorded Codex accepted/done, Claude changes_requested, Codex done, Claude changes_requested, and hub escalation to Kimi. Kimi then accepted/done through its real tools, and Claude approved the task. That assisted success does not erase the default-flow failure. |
+| Off-campus Cloudflare Access headers | blocked, [#1](https://github.com/STAIxBWLB/agent-hub/issues/1) | Internal gateway reachable; both Access credential-file settings empty; unauthenticated public models probe HTTP 403. Needs authorized Access credentials and an off-campus network. VPN was not disconnected. |
+| Natural Codex budget pause with TUI attached | blocked, [#1](https://github.com/STAIxBWLB/agent-hub/issues/1) | Actual TUI-connected weekly reading was approximately 12%, below the gate. No manual budget reading was injected. Needs a naturally near-limit account; parser and manual-injection tests are not this live leg. |
 
 ### Environment findings
 
@@ -368,7 +368,7 @@ check: OK
 ```
 
 This gate covers type checking, bundle freshness, package contents and tests;
-it does not replace the live outcomes or unblock #11 and #12.
+it does not replace the live outcomes or unblock #11 (previous repository) and #1.
 
 ## Issue #11 default workflow retest (0.3.1)
 
@@ -400,7 +400,7 @@ instruction was entered into the Codex TUI. Real board history for
 
 This closes the default acceptance/review/escalation failure found in the
 0.3.0 issue #7 run. The earlier failure is retained above as historical evidence.
-The off-campus Access and natural budget-pause prerequisites in #12 remain open.
+The off-campus Access and natural budget-pause prerequisites in #1 remain open.
 
 Regression gate: `scripts/check.sh` completed with `159 pass`, `0 fail`,
 `1045 expect() calls`, `check: OK`. Added coverage exercises rendered workflow
@@ -492,7 +492,7 @@ The 0.7.0 protocol-10 durable-delivery implementation, source-9-to-target-10
 transition, queue CLI, receipt reconciliation, and attended Claude
 confirmation remain pending live verification. Do not claim a successful
 0.7.0 production cutover from package installation, tests, or synthetic
-approval alone. Issue [#12](https://github.com/STAIxBWLB/agent-hub/issues/12)
+approval alone. Issue [#1](https://github.com/STAIxBWLB/agent-hub/issues/1)
 remains open for off-campus Access credentials and a natural near-limit budget
 pause.
 
@@ -522,7 +522,7 @@ pause.
 - The synthetic Claude control peer acknowledged bridge receipt and replied
   with a correlated FYI. This does not establish a real Claude inference turn.
 - Production application, attended Claude restoration and post-deploy readback
-  remain pending until the tagged artifact is installed. Issue #12 remains open.
+  remain pending until the tagged artifact is installed. Issue #1 remains open.
 
 
 ## 0.7.0 attended production cutover and follow-up
@@ -569,7 +569,7 @@ The 0.7.1 attended repeat is recorded separately after application.
 - `ahub doctor` reported all configured checks healthy, including the delivery
   journal and Claude recovery identity. The hwp-cli hub remained stopped.
 - These are supervised live checks. Native confirmation screens, uncertain
-  delivery review, and the infrastructure prerequisites in #12 remain explicit
+  delivery review, and the infrastructure prerequisites in #1 remain explicit
   operator responsibilities; this does not certify unattended operation.
 
 
@@ -595,7 +595,7 @@ verified application; no daemon, plugin, terminal, or journal mutation.
   for the 0.7.1 application; no source change is present on HEAD.
 - Kimi reports 2.0.2 in doctor; earlier live legs on this page used 2.0.1.
 
-Issue [#12](https://github.com/STAIxBWLB/agent-hub/issues/12) remains open
+Issue [#1](https://github.com/STAIxBWLB/agent-hub/issues/1) remains open
 for off-campus Access credentials and a natural near-limit budget pause.
 
 
@@ -690,6 +690,160 @@ cutover; it also exposed three recovery defects that became 0.7.3 and 0.7.4.
   sourceRoot digest guard correctly refused a hand-patched receipt.
 - `ahub setup` is interactive (one confirmation gates all steps); piping an
   answer works, running it detached does not.
+  (Changed in 0.7.7: without a terminal it no longer reads a piped answer; use
+  `--yes`.)
 
-Issue [#12](https://github.com/STAIxBWLB/agent-hub/issues/12) remains open
+Issue [#1](https://github.com/STAIxBWLB/agent-hub/issues/1) remains open
 for off-campus Access credentials and a natural near-limit budget pause.
+
+## Shared notes and claims live run (issue #68, 0.7.6, 2026-09-30)
+
+Measured against the released 0.7.6 package (global CLI and Claude plugin both
+0.7.6 after `ahub setup`) in a disposable git project, with real Kimi 2.1.1 under
+ACP and real Codex (codex-cli 0.156.1) behind the hub's app-server proxy. A script
+stood in for the Codex TUI (the `scripts/smoke-codex.ts` pattern, attached to the
+live daemon's proxy). No Claude peer was attached. No console message named a tool
+or a note kind; the role text and the AGENTS.md block in the peers' prompts do, by
+design. Times are hub.log timestamps (UTC).
+
+- Fail note, kind chosen by the model: asked at 03:07:24.886Z to "record this for
+  the other agents so nobody retries it" (a WeakMap cannot replace this
+  string-keyed Map), Codex called `hub_remember` with `kind: "fail"` on its own,
+  with a title and "Do not retry this replacement without a different key model
+  or new evidence". The log showed `note from codex [fail]: ...` at 03:07:32.331Z
+  (7.4 s); Codex closed with `[FYI]`, so nobody's turn was spent on the answer.
+- No turn of its own: Kimi was idle with nothing queued and made no `busy`
+  transition between the note and the next console message.
+- Ride-along, once: the next console question to Kimi at 03:07:48.827Z ("Should
+  src/cache.ts switch its Map to a WeakMap so entries can be garbage
+  collected? ...", without mentioning the note) was delivered with the note in the
+  same prompt. Kimi's session transcript has the note in the first of its three
+  turn prompts only. Kimi answered "No" at 03:08:06.398Z (17.6 s) and said the
+  answer "rests on the code itself plus codex's earlier recorded fail note". The
+  same first prompt also carried 1042 chars of claude-mem recall from an unrelated
+  earlier project: claude-mem keys a project by its directory name, and this one
+  was `proj`. Later runs should use a unique directory name.
+- Self-claim: told to claim unassigned work without editing, Kimi picked
+  `hub_task_propose` with `owner: kimi` and `refs: src/cache.ts` itself. Task #1
+  went straight to `in_progress` (`proposed` at 03:11:40.342Z, `claimed by kimi`
+  at 03:11:40.343Z, reviewer codex), and no task envelope came back to Kimi.
+- Overlap: Codex then claimed "everything under src/" (`owner: codex`,
+  `refs.paths: ["src/"]`). Its tool result carried `Overlaps #1 (owner kimi) on
+  src/. Settle it with that owner via hub_send before editing those paths.`, the
+  console printed `... Overlaps #1 (owner kimi) on src/. codex is told to settle
+  it.` at 03:12:01.494Z, and Kimi received nothing. Codex acknowledged the overlap
+  in its `[FYI]` answer (in Korean, translated: coordination is needed before
+  editing) and did not message Kimi in the claim turn: it had been told not to
+  edit yet, and the guidance asks for settlement before editing.
+- Environmental limit: Kimi 2.1.1 asked approval for both of its
+  `hub_task_propose` calls (its `Read` call asked for none), and sent no
+  `rawInput` before the approval, so unlike 2.0.1 the hub had nothing to show:
+  the console read `mcp__agent-hub__hub_task_propose (payload not reported by
+  the agent)` with `approve_once` / `reject` only (the always option is withheld,
+  as designed). Kimi's own transcript records the approval before its tool-call
+  event, so the arguments seem to arrive after the request (inferred, not
+  captured on the ACP stream). The first request (03:08:48.088Z) went unanswered,
+  was cancelled at the 120 s permission timeout, and the claim was lost; Kimi
+  reported that accurately at 03:10:58.585Z. Codex called the same tools without
+  an approval. A Kimi that should claim or record notes unattended needs a
+  tool-approval policy of its own for the agent-hub server; the hub does not
+  change it.
+- The disposable hub was stopped and its registration removed after recording.
+
+## Kimi approvals for the hub's own tools (issue #72, 2026-09-30)
+
+Kimi 2.1.1 under ACP. The capture used a small ACP client of its own with the hub's
+tools server; the live run used a disposable project and a hub built from the PR
+branch. Times are hub.log timestamps (UTC).
+
+- ACP stream, captured for `mcp__agent-hub__hub_task_list` (saved) and observed in a
+  second capture for `Bash` (`echo probe-72`; output not kept, and the live run
+  below shows the same command on the console): `tool_call` (`pending`) names the
+  tool and has no `rawInput`;
+  `tool_call_update` (`in_progress`) streams the argument JSON cumulatively as
+  `content` text (`{"command":"` ... `{"command":"echo probe-72"}`); then
+  `session/request_permission` arrives with no `rawInput` and Kimi's own line
+  (`Requesting approval to Running: echo probe-72`); `rawInput` appears only on the
+  update after the answer. Options: `approve_once`, `approve_always` ("Approve for
+  this session"), `reject`. `session/new` offers modes `default`, `plan`, `auto`,
+  `yolo` and nothing per server or tool.
+- Unattended claim and note: with no console tail open, one message at
+  05:40:04.837Z asked Kimi to claim unassigned work and record why a WeakMap cannot
+  replace the string-keyed Map. hub.log shows
+  `permission auto-approved for kimi: mcp__agent-hub__hub_task_propose`
+  (05:40:17.083Z), `... hub_remember` (05:40:17.104Z), the note
+  `note from kimi [fail]: ...` (05:40:17.126Z, kind chosen by Kimi), and a second
+  auto-approved `hub_task_propose` (05:40:22.741Z) that claimed task #1
+  (`claimed by kimi` at 05:40:22.749Z). Kimi's first propose had no `class`; this
+  hub had no triage model, so it answered `class is required` and Kimi retried with
+  `implement`. Kimi closed with `[FYI]` at 05:40:26.318Z. Nobody answered anything.
+- Other tools still ask, now with the arguments: asked to run `echo probe-72`, Kimi's
+  request reached the console at 05:40:58.696Z as `kimi asks permission: Bash:
+  {"command":"echo probe-72"}`, with `approve_always` offered again because the
+  payload was complete. It was rejected; Kimi did not run it and said so at
+  05:41:04.397Z.
+- The disposable hub was stopped and its registration removed after recording.
+
+## Upgrade sources for the operations guide (issue #75, 2026-09-30)
+
+Two disposable projects, each the only running registered project at the time,
+ran a released hub through `bunx --package @staix/agent-hub@<version> ahub up`:
+0.7.5 (hub.log `ahub up` at 05:43:12.894Z) and 0.6.4 (06:13:57.001Z).
+
+- From 0.7.5 (protocol 10): `bunx --package @staix/agent-hub@0.7.6 ahub upgrade
+  --to 0.7.6 --dry-run` exited 0 with plan `kind: upgrade`, `version: 0.7.6`, no
+  plan blockers; the project read as `running`, source 0.7.5, protocol 10, no
+  project blockers. The installed 0.7.6 CLI's dry-run showed the same project,
+  source and blockers (its `sourceRoot`, and so its fingerprint, differ).
+- From 0.6.4 (protocol 9): the same 0.7.6 dry-run exited 0 with no plan or
+  project blockers; the project read as `running`, source 0.6.4, protocol 9.
+- Nothing changed: each hub kept running, and its hub.log gained no line until it
+  was stopped for cleanup.
+- Code basis: `RECOVERY_SOURCE_PROTOCOLS = [9, PROTOCOL]`
+  (`src/hub/control-client.ts`) admits a running protocol-9 or protocol-10 source
+  (`makeUpgradePlan` in `src/cli/upgrade-runtime.ts`); an older one is refused as
+  `manual-bootstrap-required`; the staged target must report the coordinator's own
+  `PROTOCOL` (`stage` in the same file).
+- Not measured here: an applied (`--yes`) upgrade from either source (last proven
+  with the 0.7.0 coordinator, see above), and session or terminal planning: no peer
+  was attached, so `peers` and `terminals` were empty.
+- Both hubs were stopped and their registrations removed after recording.
+
+## Approval notice and timeout (issue #5, 2026-09-30)
+
+A disposable project initialised by the PR branch (`approvals: { timeout_s: 120 }`
+from the template, `notify` left to its macOS default) with real Kimi 2.1.1. Times
+are hub.log timestamps (UTC).
+
+- Asked to run `echo notify-live-5`, Kimi's request was logged at 11:33:43.793Z as
+  `permission 8743d41c requested by kimi (38 chars, shown on the console; cancelled
+  after 120s)`. Notifications were on by the macOS default (the template sets no
+  `notify`), and no notifier failure line appeared (it logs a spawn error, a
+  non-zero exit or its 5 s kill). A clean exit does not prove a banner showed: that
+  is visual and not captured here, so the owner confirms it on the next use.
+- The request was rejected from the console; Kimi said so at 11:34:03.468Z and ran
+  nothing.
+- The disposable hub was stopped and its registration removed after recording.
+
+## Overlap measurement (issue #8, from 2026-09-30)
+
+Whether per-task worktrees get built depends on this: two weeks of normal use with
+the claim overlap warnings (0.7.6 and later), then the owner decides in issue #8.
+
+- Count, from a checkout of this repository: `ahub projects --json | jq -r
+  '.[].stateDir + "/hub.log"' | tr '\n' '\0' | xargs -0 bun scripts/overlaps.ts
+  --since <start date>`. It reads only the hub's overlap notice lines and prints,
+  per week (Monday, UTC), the number of warnings and each pair of tasks once per
+  project, with its owners, shared paths, first warning and count. A registered
+  project without a hub.log is skipped with a note.
+- Per pair, decide whether it led to conflicting edits: from that project's root,
+  with its hub running, `ahub task show <id>` for both tasks, and `git log --since
+  <first warning> -- <shared paths>`. A conflicting edit is a commit that
+  overwrote or reverted the other task's change, a merge conflict between the two,
+  or a build or test run broken by the other task's half-done change.
+- Record only the numbers and the verdicts below. The script's output names tasks
+  and paths of private projects: it stays local.
+
+| Week of | Warnings | Task pairs | Pairs with a conflicting edit | Notes |
+|---|---|---|---|---|
+| 2026-09-28 | 0 | 0 | 0 | baseline counted on 2026-09-30 over every registered project; the issue #68 live run's project was already removed |

package/docs/specs/2026-09-19-agent-hub-design.md

@@ -1,6 +1,6 @@
 # agent-hub design spec
 
-Date: 2026-09-19. Status: M1 to M5 merged; M6 implemented on `feat/m6-packaging-inference` (phase spec: issue #2 of the public repository). Version 0.1.0.
+Date: 2026-09-19. Status: M1 to M5 merged; M6 implemented on `feat/m6-packaging-inference` (phase spec: issue #2 of the first public repository, archived). Version 0.1.0.
 Owner: Young Joon Lee. Repo: STAIxBWLB/agent-hub.
 
 Facts below are tagged **verified** (measured on 2026-09-19 on the owner's Mac) or
@@ -565,7 +565,7 @@ M2 coordination
 
 M3 local worker and routing L2/L3
 - [x] Local worker agent loop with cwd-scoped tools, secrets denylist, approvals and seatbelt sandbox
-- [x] OmniRoute client with Cloudflare Access headers and the owner-issued inference key; the off-campus live path remains blocked in `docs/smoke.md` (#12)
+- [x] OmniRoute client with Cloudflare Access headers and the owner-issued inference key; the off-campus live path remains blocked in `docs/smoke.md` (#1)
 - [x] Switchyard sidecar: config generation, lifecycle, health, fallback to fixed model
 - [x] `ahub local`, smoke through OmniRoute with provider header check, and through the real sidecar
 - [x] Local worker capture into claude-mem (`sessions/init`, `observations`, `summarize`, `session-end`, skip list)
@@ -584,7 +584,7 @@ M5 budget relay
 - [x] Reassignment to local, one resume envelope, idempotency and restart recovery
 - [x] Handoff context (checkpoint summary or memory block) plus task briefs in the task envelope
 - [x] Live: the Claude status line tee in an interactive session (`docs/smoke.md`, 2026-09-19)
-- [ ] Live: a real pause driven by Codex's own numbers with a TUI attached; the natural near-limit prerequisite remains blocked by issue #12
+- [ ] Live: a real pause driven by Codex's own numbers with a TUI attached; the natural near-limit prerequisite remains blocked by issue #1
 
 M6 internal inference, packaging
 - [x] Status digests and triage through `sy/fast` (amended: optional and fail-open with a backoff. Only plain status
@@ -615,6 +615,9 @@ M6 internal inference, packaging
   publicly with provenance and `NPM_TOKEN`. The token belongs to an authorized
   organization member. Organization conversion and credential provisioning are
   owner operations; this implementation does not perform them.
+- Amended 2026-09-30 (issue #4 of this repository): publishing uses npm trusted
+  publishing (OIDC) with no stored token; npm 11.5.1 or later publishes provenance by
+  itself. Registering the trusted publisher on npmjs.com is an owner operation.
 - The v0.4.0 release workflow completed registry publication with provenance.
   Registry metadata/provenance readback and real Claude setup from a clean registry
   installation remain to be verified.
@@ -727,3 +730,89 @@ that need no new service and cost no peer an extra turn.
   envelope's closing line ask for what changed, why, and the check that was run with
   its result. The verifier role already asks for what passed and what did not, so it
   stays as it was.
+
+## Amendment: Kimi approvals for the hub's own tools (issue #72)
+
+Measured on Kimi 2.1.1 (ACP stream captured on 2026-09-30): a permission request
+carries no `rawInput`; the argument JSON streams before it as `content` text on
+`tool_call_update`, and `rawInput` arrives only after the answer. Kimi offers
+session modes (`default`, `plan`, `auto`, `yolo`) but nothing per server or tool.
+
+- Kimi's requests for exactly `mcp__agent-hub__<name>`, where `<name>` is
+  `hub_send` or a task tool, are answered with their `allow_once` option by the
+  hub, without a console prompt, and logged by tool name only. This matches the
+  `approval_mode = "approve"` Codex already gets for the same tools. Every other
+  request keeps the console path; `allow_always` is never chosen automatically.
+- For the other tools, the console payload falls back to the streamed argument
+  text once it is a complete JSON object. A partial stream stays unresolved and
+  keeps `allow_always` withheld.
+- For every ACP agent, `rawInput` included: a payload longer than the 600
+  characters the console shows is marked `[cut, N chars]` and withholds
+  `allow_always`, because the hidden tail can change what runs.
+- Name collisions (inferred from reading Kimi 2.1.1's bundled code, not tested
+  live): tool names are qualified as `mcp__<server>__<tool>` after replacing
+  anything outside `[a-zA-Z0-9_-]`, and a server passed in `session/new` shadows a
+  configured server of the same name, so only the hub's `agent-hub` server can
+  produce the approved names.
+
+## Amendment: approval notifications and timeout (issue #5)
+
+- A waiting permission request raises one macOS notification (`osascript`) with
+  the peer and, when the adapter reports it apart from the title (ACP), the tool
+  name; never the title or payload, which can quote a PII turn. Failures are logged
+  once and never affect the request.
+- `approvals.timeout_s` (default 120, accepted 30 to 3600, otherwise 120 with a log
+  line) replaces the fixed 120 s; an unanswered request leaves a console and log
+  line.
+- `approvals.notify` defaults to on for macOS when a project config file exists and
+  to off otherwise (tests, a hub without a config), so test runs raise nothing; a
+  non-boolean value is ignored.
+- The ACP adapter keeps its inactivity watchdog alive while a permission request
+  waits (as the local worker already did), so a timeout above `watchdog_ms` does
+  not cancel the turn. The tool name travels to the notifier only; the console
+  `permission` push keeps its shape, so the control protocol is unchanged.
+
+## Amendment: claim robustness (issue #6)
+
+- A self-claim (`owner` equal to the caller) without a class, when triage names
+  none, is filed as `implement` and its history says so; a proposal for another
+  owner still needs a class.
+- When a new owner's paths overlap an open task of another owner, that earlier
+  owner gets one line through the preface path (`note from hub [finding]: task #N
+  (owner X) now overlaps your #M on <paths>; X is told to settle it`), capped with
+  shared notes, never a delivery of its own. PII tasks stay out on both sides.
+- An owner offline longer than `tasks.release_after_min` (default 30; 0 disables)
+  loses its open tasks, released and reassigned by class routing (not the budget
+  handoff's local-first list), but only when routing finds another owner;
+  otherwise the task stays. Each task is re-read before it moves, so one changed
+  meanwhile (reassigned, finished, owner back) is left alone; runs never overlap,
+  and a recovery commit waits for a run in progress. Paused peers and hubs in a
+  recovery operation are skipped. A peer never seen attached counts from hub
+  start. The gone owner gets a line on its next delivery naming where each task
+  went. Reviewers are not moved by this.
+
+## Amendment: completion checks (issue #7)
+
+- `checks.<class>` in `.agenthub/config.json` names a command; `checks.timeout_s`
+  (default 600, 1 to 3600) bounds it. The hub runs `checks` only when git
+  confirms nobody committed that file (any letter case, nor a symlink or submodule
+  at `.agenthub`); without a repository or on a git error it runs none. Keys that
+  are not task classes are ignored with a log line.
+- `hub_task_done` on such a class records `done (checking)` and answers at once
+  (a check can outlast an agent's tool timeout); the task stays `in_progress`. The
+  hub runs checks one at a time in the project root, in their own process group,
+  killed at the timeout or on shutdown; a check still queued at shutdown never
+  starts. A check ends when its command exits: what it left in its process group
+  is killed then, and a descendant that left the group gets 0.5 s more to flush
+  output and is not waited for. Exit 0: the task
+  completes as before, the review envelope carrying `Check: <command> -> exit 0`
+  and the output tail; shared memory gets the summary and the outcome line, never
+  the output. Any other outcome: the task stays with its owner, who gets a task
+  envelope with the command, outcome and tail; no reviewer turn is spent. A second
+  `done` while the check runs is refused; a new owner who took the task meanwhile is
+  told to try again later, since the result reaches only the owner the check was
+  started for. A task with any board event since the
+  `done` other than an answer or a reviewer change only records the result
+  (`check finished late`); if it is in progress with the same owner again, that
+  owner is asked to mark it done again. A check interrupted by a hub stop records
+  `check interrupted`, is not resumed, and the owner marks the task done again.

package/docs/specs/2026-09-20-durable-delivery-design.md

@@ -8,7 +8,7 @@ Target: 0.7.0, protocol 10
 
 Make ahub suitable for supervised daily development: expose disconnected recipients' pending work, survive daemon termination without silently losing accepted queued messages, and make uncertain execution an explicit operator decision. Publish an English operations guide and verify the release before applying it to the current installation.
 
-The user chose conservative recovery and deployment through production application. Never automatically replay uncertain or partially executed work. Exactly-once external effects, automatic rollback, and unattended native approval handling remain outside this release. Infrastructure prerequisites in issue #12 remain pending unless independently available; never manufacture quota exhaustion or disconnect the user's network.
+The user chose conservative recovery and deployment through production application. Never automatically replay uncertain or partially executed work. Exactly-once external effects, automatic rollback, and unattended native approval handling remain outside this release. Infrastructure prerequisites in issue #1 remain pending unless independently available; never manufacture quota exhaustion or disconnect the user's network.
 
 ## Delivery model