@staix/agent-hub 0.7.7 → 0.7.8

package/CHANGELOG.md

@@ -1,7 +1,19 @@
 # Changelog
 
+Issue and pull request numbers in the entries for 0.7.7 and earlier refer to the previous repository, archived on 2026-09-30 when this repository's history was rewritten; the one exception is the open smoke-check issue, formerly #12, which moved here as #1. Numbers in newer entries refer to this repository.
+
 ## Unreleased
 
+## 0.7.8
+
+- README, the operations guide and the upgrade-recovery spec no longer describe protocol 10 and the queue commands as unreleased (#9).
+- Codex answers a digest to every sender in it, and a sender steered into its turn, like the other adapters; an answer to a condensed digest no longer goes to the reserved `digest` sender and reaches no peer, also when a steer joined the turn (the bus now maps `digest` for any adapter). A TUI that detaches mid-turn and comes back no longer answers the old turn's senders (#3).
+- A waiting approval raises a macOS notification naming the peer and, for Kimi, the tool (never the payload); the approval timeout is configurable as `approvals.timeout_s`, and an unanswered request leaves a console and log line (#5).
+- Claims: a self-claim without a class is filed as `implement` when no model can name one; the earlier owner of an overlapping task hears of it with its next message; an owner offline past `tasks.release_after_min` (default 30) loses its open tasks to a peer that can take them (#6).
+- A class can carry a completion check (`checks.<class>` in a `.agenthub/config.json` git confirms nobody committed; outside a repository none runs): marking such a task done runs it, sends the task to review with the result on success, and keeps it with its owner with the failure otherwise. A hub stop interrupts a check without a verdict (#7).
+- `scripts/overlaps.ts` counts the claim overlap warnings in hub logs per week and names the task pairs, for the two-week measurement that decides whether per-task worktrees are built. The procedure and the numbers go in `docs/smoke.md` (#8).
+- Releases publish to npm through trusted publishing (OIDC) instead of a stored token, and the workflows use the Node 24 releases of `actions/checkout` and `actions/setup-node` (#4).
+
 ## 0.7.7
 
 - `ahub setup` without a terminal and without `--yes` prints the step it would take and exits non-zero instead of waiting forever at its prompt, as `restart` and `upgrade` already did. A piped answer (`yes | ahub setup`) is no longer read: use `--yes` (#73).
@@ -91,7 +103,7 @@
 ## 0.4.1 (included in 0.5.0)
 
 - Synchronize the daemon digest integration fixture without changing batching semantics or weakening digest/FYI assertions (#15).
-- Reconcile completed live smoke and npm publication evidence; infrastructure-dependent checks remain tracked in #12.
+- Reconcile completed live smoke and npm publication evidence; infrastructure-dependent checks remain tracked in #1 (formerly #12).
 
 ## 0.4.0
 

package/README.md

@@ -4,7 +4,7 @@ Native multi-agent hub for one developer's machine: Claude Code, Codex, Kimi Cod
 hub-owned local-LLM worker collaborate as peers in independent project directories, with
 task-aware model routing (Switchyard) in front of a self-hosted gateway (OmniRoute).
 
-Status: 0.7.7, control protocol 10. Durable delivery records distinguish queued
+Status: 0.7.8, control protocol 10. Durable delivery records distinguish queued
 work from uncertain execution. The [smoke checklist](docs/smoke.md) records
 verified paths and remaining prerequisites.
 
@@ -28,7 +28,7 @@ cd <your project> && ahub init && ahub up && ahub tail
 Or install the same version from GitHub:
 
 ```bash
-bun add -g github:STAIxBWLB/agent-hub#v0.7.7 && ahub setup
+bun add -g github:STAIxBWLB/agent-hub#v0.7.8 && ahub setup
 ```
 
 The installed commands remain `ahub` and `agent-hub`.
@@ -113,8 +113,9 @@ A project has one managed Pi session owner. Mode changes require the agent to
 settle and preserve the session file. Before the first generation, a live source
 verified to be empty can instead retain its exact session ID without a file.
 Missing history from a nonempty session blocks handover. Protocol 9 adds Pi
-recovery metadata. Protocol 10 is the 0.7.0 target for durable delivery
-receipts and conservative queue recovery; it is pending live verification.
+recovery metadata. Protocol 10, released in 0.7.0, adds durable delivery
+receipts and conservative queue recovery; it is verified live (see the
+[smoke checklist](docs/smoke.md)).
 Older protocol hubs still require their matching CLI and an attended bootstrap.
 
 ## Runtime

package/docs/operations.md

@@ -1,6 +1,6 @@
 # Operations guide
 
-This guide describes ahub 0.7.7 and control protocol 10. Live verification
+This guide describes ahub 0.7.8 and control protocol 10. Live verification
 results and remaining prerequisites are recorded separately in [the smoke ledger](smoke.md).
 
 ## Install and start
@@ -58,11 +58,32 @@ ahub review <task-id> approved "verified against the requested behavior"
 ahub review <task-id> changes_requested "describe the required correction"
 ```
 
+A class can carry a completion check in `.agenthub/config.json`, for example
+`"checks": { "implement": "scripts/check.sh", "timeout_s": 600 }`. When the owner
+marks such a task done, the tool answers at once, the hub runs the command in the
+project root (one at a time; what it left in its process group is killed when it
+exits, at the timeout or on shutdown), and then either
+sends the task to review with the command, exit code and output tail, or keeps it
+with its owner and tells it what failed. The hub runs `checks` only when git
+confirms that nobody committed `.agenthub/config.json`: a committed file must not
+choose commands the hub runs, and outside a git repository it runs none. Keys that
+are not task classes are ignored with a log line. A hub stopped mid-check leaves
+the task in progress (`check interrupted`); the owner marks it done again.
+
 A task reaching `approved` is a board transition. It is not proof that an
 external side effect happened unless the task's refs and a live readback show
 that effect. The hub can reassign after repeated review changes according to
 the routing configuration.
 
+An agent can claim work nobody assigned it by proposing a task with itself as
+owner; without a class, and with no model to name one, the claim is filed as
+`implement`. When a task's paths overlap another owner's open task, the newcomer
+is told to settle it and the earlier owner gets one line with its next message,
+at no turn of its own. An owner offline longer than `tasks.release_after_min`
+(default 30, `0` turns it off) in `.agenthub/config.json` loses its open tasks
+to a peer routing can give them to; with nobody to take them they stay, and a
+paused peer or a hub in a recovery operation is left alone.
+
 Use targeted messages for coordination:
 
 ```bash
@@ -86,7 +107,15 @@ ahub permit <request-id> allow
 ```
 
 Use the exact option shown by `ahub tail`; do not approve an unresolved or
-unexpected request. `ahub pause <peer>` holds delivery and `ahub resume
+unexpected request. On macOS a waiting request also raises a desktop
+notification that names the peer and, for Kimi, the tool, never what it would
+run. An unanswered request is cancelled after `approvals.timeout_s` (default
+120, 30 to 3600) in `.agenthub/config.json`, and the console and log say so.
+Set `approvals.notify` to `false` to turn notifications off; a hub started
+without a project config file raises none. While Kimi waits for an answer its
+turn is kept alive, so a timeout longer than the inactivity watchdog does not
+cancel it.
+`ahub pause <peer>` holds delivery and `ahub resume
 <peer>` releases a manual pause. Budget pauses are distinct:
 
 ```bash
@@ -114,11 +143,10 @@ ahub queue show <delivery-id>
 ahub queue resolve <delivery-id> --action completed|retry|discard --reason "<text>"
 ```
 
-These queue commands are part of 0.7.0 and are not available in the released
-0.6.4 CLI. Until protocol 10 is installed, use `ahub status`, `ahub tail`,
-and the task board. A known offline recipient may be queued explicitly once
-the 0.7.0 journal is active; broadcast and automatic assignment still require
-an attached peer.
+These queue commands ship with protocol 10 (0.7.0 and later), where a known
+offline recipient may also be queued explicitly; broadcast and automatic
+assignment still require an attached peer. A hub still on protocol 9 (0.6.x)
+has only `ahub status`, `ahub tail` and the task board.
 
 Resolution requires the current observed revision. A retry closes the old
 record and creates one linked attempt. Stale or conflicting resolutions fail.
@@ -186,8 +214,8 @@ source and carries every recovery fix released up to it. Protocol 8 and older
 project directory, without replacing the global CLI first:
 
 ```bash
-bunx --package @staix/agent-hub@0.7.7 ahub upgrade --to 0.7.7 --dry-run
-bunx --package @staix/agent-hub@0.7.7 ahub upgrade --to 0.7.7 --yes
+bunx --package @staix/agent-hub@0.7.8 ahub upgrade --to 0.7.8 --dry-run
+bunx --package @staix/agent-hub@0.7.8 ahub upgrade --to 0.7.8 --yes
 ```
 
 | Running now | Coordinator to use |
@@ -209,19 +237,19 @@ The coordinator verifies and retains the exact target package, preserves its
 own source, and promotes the global CLI only after restored projects pass
 readback.
 
-Once the installed CLI is 0.7.7, review the current project or all registered
+Once the installed CLI is 0.7.8, review the current project or all registered
 projects first:
 
 ```bash
 ahub restart --dry-run
-ahub upgrade --to 0.7.7 --dry-run
+ahub upgrade --to 0.7.8 --dry-run
 ```
 
 Apply only after reviewing the plan:
 
 ```bash
 ahub restart --yes
-ahub upgrade --to 0.7.7 --yes
+ahub upgrade --to 0.7.8 --yes
 ahub recovery status <operation-id>
 ahub recovery resume <operation-id>
 ahub recovery abort <operation-id>
@@ -264,7 +292,7 @@ peers and therefore did not show that backlog. No messages were deleted. The
 0.7.1 attended cutover and production readback verified queue visibility and
 completion receipts; see the final section of the smoke checklist.
 
-Issue [#12](https://github.com/STAIxBWLB/agent-hub/issues/12) remains open for
+Issue [#1](https://github.com/STAIxBWLB/agent-hub/issues/1) remains open for
 off-campus Access credentials and a natural near-limit budget pause. Tests,
 synthetic approvals, and an authenticated internal network do not close those
 prerequisites. Adapter acceptance is not task completion, and package

package/docs/quickstart.md

@@ -17,7 +17,7 @@ ahub setup                                # installs the Claude Code channel plu
 Or use the matching GitHub release:
 
 ```bash
-bun add -g github:STAIxBWLB/agent-hub#v0.7.7
+bun add -g github:STAIxBWLB/agent-hub#v0.7.8
 ahub setup
 ```
 

package/docs/security.md

@@ -6,7 +6,8 @@ agent-hub connects agents that can each run commands. This page says what the hu
 
 - **Other agents' text is untrusted.** Every message that crosses from one peer to another is framed as untrusted input (a channel tag with `meta.source` for Claude, a fixed header line plus a standing instruction for the others). A message body cannot forge the hub's own headers: such lines are quoted (`sanitize`). Replies inherit a hop count capped at 3, so agents cannot ping-pong forever; neither a digest nor a steer can reset it.
 - **The control link is loopback plus a secret.** The daemon and the Codex proxy bind 127.0.0.1 only. The control WebSocket requires a per-run token (`.agenthub/state/control-token`, mode 600), and both servers refuse any request that carries an `Origin` header: any web page can open a WebSocket to localhost, and browsers always send `Origin`. External clients cannot claim the console user's id or a hub-managed peer's id.
-- **Permission prompts stay on.** `ahub claude` and `ahub codex` add nothing that weakens the agents' own prompts. Kimi's and `local`'s permission requests are relayed to the console and cancelled after 120 s of silence. The one exception is the hub's own tools (`hub_send` and the task tools, matched by exact name): Kimi's requests for them are approved once without a prompt and logged by name, the same trust Codex gets through `approval_mode` in the hub's config. They touch no file and run no process, and every call passes the hub's own checks. The match relies on the agent putting the tool name in the request's `title`, as Kimi does; an ACP agent that titles calls with model-written text must not be configured as `kimi_cmd`. A payload longer than the console shows is marked as cut and never offers a session-wide grant. `--unattended` turns prompts off, says so loudly, and is never the default.
+- **Permission prompts stay on.** `ahub claude` and `ahub codex` add nothing that weakens the agents' own prompts. Kimi's and `local`'s permission requests are relayed to the console and cancelled after `approvals.timeout_s` (default 120 s) of silence; the macOS notification for a waiting request carries the peer and the tool name only. The one exception is the hub's own tools (`hub_send` and the task tools, matched by exact name): Kimi's requests for them are approved once without a prompt and logged by name, the same trust Codex gets through `approval_mode` in the hub's config. They touch no file and run no process, and every call passes the hub's own checks. The match relies on the agent putting the tool name in the request's `title`, as Kimi does; an ACP agent that titles calls with model-written text must not be configured as `kimi_cmd`. A payload longer than the console shows is marked as cut and never offers a session-wide grant. `--unattended` turns prompts off, says so loudly, and is never the default.
+- **Completion checks run only from a config nobody committed.** A command in `checks` runs as you, outside the local worker's sandbox, like a git hook, when a task of that class is marked done. The hub runs `checks` only when git confirms that `.agenthub/config.json` is not committed, in any letter case, and that `.agenthub` is not a committed symlink or submodule; without a repository, or when git fails, it runs none. So a cloned repository cannot choose a check. Nothing in `routing.toml` or in task text is ever run. The launch commands in the same file (`kimi_cmd`, `codex_bin`, `pi.cmd`) have no such guard: start a hub only in a checkout whose `.agenthub/config.json` you trust.
 - **The local worker is boxed in.** Paths are resolved through symlinks and must stay inside the project; a secrets denylist (`.env*`, keys, credential files, the hub's own state) applies to its file tools, its git arguments and its memory capture alike; `.git` and `.agenthub` are not writable. Writes, edits, shell commands and mutating git wait for approval, and the approver sees what will be written or run, with control characters escaped. Everything it executes runs under the macOS sandbox, attended or not: no writes outside the project, its git dir and temp; the home directory is unreadable except toolchains; no `.git/hooks` or `.git/config` writes; no network, loopback included. Without the sandbox there is no `bash` tool.
 - **PII has an enforced path.** A task matching `signals.pii_patterns` goes to `local` or to nobody; its text is absent from other peers' envelopes, the console stream, the log and the board listing; the console user reviews it; `local` answers such a turn to the console only, keeps it out of its history, refuses it when the only gateway is off campus, and may not save notes or spin off tasks during it. Nothing about it is sent to claude-mem, whose observer is a cloud model.
 - **Secrets stay where they are read.** The gateway key and Cloudflare Access values are read inside the gateway client and go only into request headers: never into logs, errors, envelopes, tool output, memory, or the generated Switchyard config (the key travels by environment variable name). Subscription logins of Claude, Codex and Kimi are never proxied or pooled.

package/docs/smoke.md

@@ -170,7 +170,7 @@ Verified on 2026-09-20, without upgrading the developer's running hubs:
 Still pending: a real Orca smoke with native Codex/Claude sessions after an
 attended protocol-8 bootstrap; actual registry package/plugin upgrade; production
 rollout. Fake terminal receipts do not establish native conversation restoration.
-Issue #12's Access and natural-quota prerequisites remain unchanged.
+Issue #1's Access and natural-quota prerequisites remain unchanged.
 
 ## Install
 
@@ -333,9 +333,9 @@ No production task or source file was used as a test target.
 | Claude task proposal and review tools | pass | The actual plugin `hub_task_propose` created scratch task #1, `ISSUE7-REVIEW-FLOW`, at 12:44:20 UTC, attributed to `claude`. The first assignment remained empty because the Codex peer had been detached; proposal success is separate from handoff success. Claude subsequently issued two actual `hub_review` calls with `changes_requested` at 12:47:50 and 12:47:59 UTC. |
 | Real Codex TUI queue and MCP tools | pass | With Codex 0.155.1 TUI attached, a typed user turn ran `sleep 30`; the status message showed `busy queued 1`, appeared in the transcript only after the user turn completed, and invoked the actual `hub_task_list` before replying `QUEUE-DELIVERED`. |
 | Real Codex TUI steer | pass | In a second typed user turn, the TUI prompt explicitly authorized a console marker update while `sleep 20` ran. An important message arrived at 12:48:15 UTC; queue remained 0; the same turn ended at 12:48:39 UTC with `STEER-VERIFIED` at hop 1. The first probe delivered its steer but the model retained the original user instruction, so that attempt was not counted as behavioral success. |
-| Unassisted Claude proposal -> Codex completion -> Claude review and escalation | fail, [#11](https://github.com/STAIxBWLB/agent-hub/issues/11) | Task #1 was delivered to Codex at 12:47:05 UTC; it replied `Task #1 noted; no action taken on the hub reference message.` and left the task proposed. Generated instructions classify every hub item as reference-only memory. After a corrective user prompt in the TUI, board history recorded Codex accepted/done, Claude changes_requested, Codex done, Claude changes_requested, and hub escalation to Kimi. Kimi then accepted/done through its real tools, and Claude approved the task. That assisted success does not erase the default-flow failure. |
-| Off-campus Cloudflare Access headers | blocked, [#12](https://github.com/STAIxBWLB/agent-hub/issues/12) | Internal gateway reachable; both Access credential-file settings empty; unauthenticated public models probe HTTP 403. Needs authorized Access credentials and an off-campus network. VPN was not disconnected. |
-| Natural Codex budget pause with TUI attached | blocked, [#12](https://github.com/STAIxBWLB/agent-hub/issues/12) | Actual TUI-connected weekly reading was approximately 12%, below the gate. No manual budget reading was injected. Needs a naturally near-limit account; parser and manual-injection tests are not this live leg. |
+| Unassisted Claude proposal -> Codex completion -> Claude review and escalation | fail, #11 (previous repository) | Task #1 was delivered to Codex at 12:47:05 UTC; it replied `Task #1 noted; no action taken on the hub reference message.` and left the task proposed. Generated instructions classify every hub item as reference-only memory. After a corrective user prompt in the TUI, board history recorded Codex accepted/done, Claude changes_requested, Codex done, Claude changes_requested, and hub escalation to Kimi. Kimi then accepted/done through its real tools, and Claude approved the task. That assisted success does not erase the default-flow failure. |
+| Off-campus Cloudflare Access headers | blocked, [#1](https://github.com/STAIxBWLB/agent-hub/issues/1) | Internal gateway reachable; both Access credential-file settings empty; unauthenticated public models probe HTTP 403. Needs authorized Access credentials and an off-campus network. VPN was not disconnected. |
+| Natural Codex budget pause with TUI attached | blocked, [#1](https://github.com/STAIxBWLB/agent-hub/issues/1) | Actual TUI-connected weekly reading was approximately 12%, below the gate. No manual budget reading was injected. Needs a naturally near-limit account; parser and manual-injection tests are not this live leg. |
 
 ### Environment findings
 
@@ -368,7 +368,7 @@ check: OK
 ```
 
 This gate covers type checking, bundle freshness, package contents and tests;
-it does not replace the live outcomes or unblock #11 and #12.
+it does not replace the live outcomes or unblock #11 (previous repository) and #1.
 
 ## Issue #11 default workflow retest (0.3.1)
 
@@ -400,7 +400,7 @@ instruction was entered into the Codex TUI. Real board history for
 
 This closes the default acceptance/review/escalation failure found in the
 0.3.0 issue #7 run. The earlier failure is retained above as historical evidence.
-The off-campus Access and natural budget-pause prerequisites in #12 remain open.
+The off-campus Access and natural budget-pause prerequisites in #1 remain open.
 
 Regression gate: `scripts/check.sh` completed with `159 pass`, `0 fail`,
 `1045 expect() calls`, `check: OK`. Added coverage exercises rendered workflow
@@ -492,7 +492,7 @@ The 0.7.0 protocol-10 durable-delivery implementation, source-9-to-target-10
 transition, queue CLI, receipt reconciliation, and attended Claude
 confirmation remain pending live verification. Do not claim a successful
 0.7.0 production cutover from package installation, tests, or synthetic
-approval alone. Issue [#12](https://github.com/STAIxBWLB/agent-hub/issues/12)
+approval alone. Issue [#1](https://github.com/STAIxBWLB/agent-hub/issues/1)
 remains open for off-campus Access credentials and a natural near-limit budget
 pause.
 
@@ -522,7 +522,7 @@ pause.
 - The synthetic Claude control peer acknowledged bridge receipt and replied
   with a correlated FYI. This does not establish a real Claude inference turn.
 - Production application, attended Claude restoration and post-deploy readback
-  remain pending until the tagged artifact is installed. Issue #12 remains open.
+  remain pending until the tagged artifact is installed. Issue #1 remains open.
 
 
 ## 0.7.0 attended production cutover and follow-up
@@ -569,7 +569,7 @@ The 0.7.1 attended repeat is recorded separately after application.
 - `ahub doctor` reported all configured checks healthy, including the delivery
   journal and Claude recovery identity. The hwp-cli hub remained stopped.
 - These are supervised live checks. Native confirmation screens, uncertain
-  delivery review, and the infrastructure prerequisites in #12 remain explicit
+  delivery review, and the infrastructure prerequisites in #1 remain explicit
   operator responsibilities; this does not certify unattended operation.
 
 
@@ -595,7 +595,7 @@ verified application; no daemon, plugin, terminal, or journal mutation.
   for the 0.7.1 application; no source change is present on HEAD.
 - Kimi reports 2.0.2 in doctor; earlier live legs on this page used 2.0.1.
 
-Issue [#12](https://github.com/STAIxBWLB/agent-hub/issues/12) remains open
+Issue [#1](https://github.com/STAIxBWLB/agent-hub/issues/1) remains open
 for off-campus Access credentials and a natural near-limit budget pause.
 
 
@@ -690,8 +690,10 @@ cutover; it also exposed three recovery defects that became 0.7.3 and 0.7.4.
   sourceRoot digest guard correctly refused a hand-patched receipt.
 - `ahub setup` is interactive (one confirmation gates all steps); piping an
   answer works, running it detached does not.
+  (Changed in 0.7.7: without a terminal it no longer reads a piped answer; use
+  `--yes`.)
 
-Issue [#12](https://github.com/STAIxBWLB/agent-hub/issues/12) remains open
+Issue [#1](https://github.com/STAIxBWLB/agent-hub/issues/1) remains open
 for off-campus Access credentials and a natural near-limit budget pause.
 
 ## Shared notes and claims live run (issue #68, 0.7.6, 2026-09-30)
@@ -806,3 +808,42 @@ ran a released hub through `bunx --package @staix/agent-hub@<version> ahub up`:
   with the 0.7.0 coordinator, see above), and session or terminal planning: no peer
   was attached, so `peers` and `terminals` were empty.
 - Both hubs were stopped and their registrations removed after recording.
+
+## Approval notice and timeout (issue #5, 2026-09-30)
+
+A disposable project initialised by the PR branch (`approvals: { timeout_s: 120 }`
+from the template, `notify` left to its macOS default) with real Kimi 2.1.1. Times
+are hub.log timestamps (UTC).
+
+- Asked to run `echo notify-live-5`, Kimi's request was logged at 11:33:43.793Z as
+  `permission 8743d41c requested by kimi (38 chars, shown on the console; cancelled
+  after 120s)`. Notifications were on by the macOS default (the template sets no
+  `notify`), and no notifier failure line appeared (it logs a spawn error, a
+  non-zero exit or its 5 s kill). A clean exit does not prove a banner showed: that
+  is visual and not captured here, so the owner confirms it on the next use.
+- The request was rejected from the console; Kimi said so at 11:34:03.468Z and ran
+  nothing.
+- The disposable hub was stopped and its registration removed after recording.
+
+## Overlap measurement (issue #8, from 2026-09-30)
+
+Whether per-task worktrees get built depends on this: two weeks of normal use with
+the claim overlap warnings (0.7.6 and later), then the owner decides in issue #8.
+
+- Count, from a checkout of this repository: `ahub projects --json | jq -r
+  '.[].stateDir + "/hub.log"' | tr '\n' '\0' | xargs -0 bun scripts/overlaps.ts
+  --since <start date>`. It reads only the hub's overlap notice lines and prints,
+  per week (Monday, UTC), the number of warnings and each pair of tasks once per
+  project, with its owners, shared paths, first warning and count. A registered
+  project without a hub.log is skipped with a note.
+- Per pair, decide whether it led to conflicting edits: from that project's root,
+  with its hub running, `ahub task show <id>` for both tasks, and `git log --since
+  <first warning> -- <shared paths>`. A conflicting edit is a commit that
+  overwrote or reverted the other task's change, a merge conflict between the two,
+  or a build or test run broken by the other task's half-done change.
+- Record only the numbers and the verdicts below. The script's output names tasks
+  and paths of private projects: it stays local.
+
+| Week of | Warnings | Task pairs | Pairs with a conflicting edit | Notes |
+|---|---|---|---|---|
+| 2026-09-28 | 0 | 0 | 0 | baseline counted on 2026-09-30 over every registered project; the issue #68 live run's project was already removed |

package/docs/specs/2026-09-19-agent-hub-design.md

@@ -1,6 +1,6 @@
 # agent-hub design spec
 
-Date: 2026-09-19. Status: M1 to M5 merged; M6 implemented on `feat/m6-packaging-inference` (phase spec: issue #2 of the public repository). Version 0.1.0.
+Date: 2026-09-19. Status: M1 to M5 merged; M6 implemented on `feat/m6-packaging-inference` (phase spec: issue #2 of the first public repository, archived). Version 0.1.0.
 Owner: Young Joon Lee. Repo: STAIxBWLB/agent-hub.
 
 Facts below are tagged **verified** (measured on 2026-09-19 on the owner's Mac) or
@@ -565,7 +565,7 @@ M2 coordination
 
 M3 local worker and routing L2/L3
 - [x] Local worker agent loop with cwd-scoped tools, secrets denylist, approvals and seatbelt sandbox
-- [x] OmniRoute client with Cloudflare Access headers and the owner-issued inference key; the off-campus live path remains blocked in `docs/smoke.md` (#12)
+- [x] OmniRoute client with Cloudflare Access headers and the owner-issued inference key; the off-campus live path remains blocked in `docs/smoke.md` (#1)
 - [x] Switchyard sidecar: config generation, lifecycle, health, fallback to fixed model
 - [x] `ahub local`, smoke through OmniRoute with provider header check, and through the real sidecar
 - [x] Local worker capture into claude-mem (`sessions/init`, `observations`, `summarize`, `session-end`, skip list)
@@ -584,7 +584,7 @@ M5 budget relay
 - [x] Reassignment to local, one resume envelope, idempotency and restart recovery
 - [x] Handoff context (checkpoint summary or memory block) plus task briefs in the task envelope
 - [x] Live: the Claude status line tee in an interactive session (`docs/smoke.md`, 2026-09-19)
-- [ ] Live: a real pause driven by Codex's own numbers with a TUI attached; the natural near-limit prerequisite remains blocked by issue #12
+- [ ] Live: a real pause driven by Codex's own numbers with a TUI attached; the natural near-limit prerequisite remains blocked by issue #1
 
 M6 internal inference, packaging
 - [x] Status digests and triage through `sy/fast` (amended: optional and fail-open with a backoff. Only plain status
@@ -615,6 +615,9 @@ M6 internal inference, packaging
   publicly with provenance and `NPM_TOKEN`. The token belongs to an authorized
   organization member. Organization conversion and credential provisioning are
   owner operations; this implementation does not perform them.
+- Amended 2026-09-30 (issue #4 of this repository): publishing uses npm trusted
+  publishing (OIDC) with no stored token; npm 11.5.1 or later publishes provenance by
+  itself. Registering the trusted publisher on npmjs.com is an owner operation.
 - The v0.4.0 release workflow completed registry publication with provenance.
   Registry metadata/provenance readback and real Claude setup from a clean registry
   installation remain to be verified.
@@ -751,3 +754,65 @@ session modes (`default`, `plan`, `auto`, `yolo`) but nothing per server or tool
   anything outside `[a-zA-Z0-9_-]`, and a server passed in `session/new` shadows a
   configured server of the same name, so only the hub's `agent-hub` server can
   produce the approved names.
+
+## Amendment: approval notifications and timeout (issue #5)
+
+- A waiting permission request raises one macOS notification (`osascript`) with
+  the peer and, when the adapter reports it apart from the title (ACP), the tool
+  name; never the title or payload, which can quote a PII turn. Failures are logged
+  once and never affect the request.
+- `approvals.timeout_s` (default 120, accepted 30 to 3600, otherwise 120 with a log
+  line) replaces the fixed 120 s; an unanswered request leaves a console and log
+  line.
+- `approvals.notify` defaults to on for macOS when a project config file exists and
+  to off otherwise (tests, a hub without a config), so test runs raise nothing; a
+  non-boolean value is ignored.
+- The ACP adapter keeps its inactivity watchdog alive while a permission request
+  waits (as the local worker already did), so a timeout above `watchdog_ms` does
+  not cancel the turn. The tool name travels to the notifier only; the console
+  `permission` push keeps its shape, so the control protocol is unchanged.
+
+## Amendment: claim robustness (issue #6)
+
+- A self-claim (`owner` equal to the caller) without a class, when triage names
+  none, is filed as `implement` and its history says so; a proposal for another
+  owner still needs a class.
+- When a new owner's paths overlap an open task of another owner, that earlier
+  owner gets one line through the preface path (`note from hub [finding]: task #N
+  (owner X) now overlaps your #M on <paths>; X is told to settle it`), capped with
+  shared notes, never a delivery of its own. PII tasks stay out on both sides.
+- An owner offline longer than `tasks.release_after_min` (default 30; 0 disables)
+  loses its open tasks, released and reassigned by class routing (not the budget
+  handoff's local-first list), but only when routing finds another owner;
+  otherwise the task stays. Each task is re-read before it moves, so one changed
+  meanwhile (reassigned, finished, owner back) is left alone; runs never overlap,
+  and a recovery commit waits for a run in progress. Paused peers and hubs in a
+  recovery operation are skipped. A peer never seen attached counts from hub
+  start. The gone owner gets a line on its next delivery naming where each task
+  went. Reviewers are not moved by this.
+
+## Amendment: completion checks (issue #7)
+
+- `checks.<class>` in `.agenthub/config.json` names a command; `checks.timeout_s`
+  (default 600, 1 to 3600) bounds it. The hub runs `checks` only when git
+  confirms nobody committed that file (any letter case, nor a symlink or submodule
+  at `.agenthub`); without a repository or on a git error it runs none. Keys that
+  are not task classes are ignored with a log line.
+- `hub_task_done` on such a class records `done (checking)` and answers at once
+  (a check can outlast an agent's tool timeout); the task stays `in_progress`. The
+  hub runs checks one at a time in the project root, in their own process group,
+  killed at the timeout or on shutdown; a check still queued at shutdown never
+  starts. A check ends when its command exits: what it left in its process group
+  is killed then, and a descendant that left the group gets 0.5 s more to flush
+  output and is not waited for. Exit 0: the task
+  completes as before, the review envelope carrying `Check: <command> -> exit 0`
+  and the output tail; shared memory gets the summary and the outcome line, never
+  the output. Any other outcome: the task stays with its owner, who gets a task
+  envelope with the command, outcome and tail; no reviewer turn is spent. A second
+  `done` while the check runs is refused; a new owner who took the task meanwhile is
+  told to try again later, since the result reaches only the owner the check was
+  started for. A task with any board event since the
+  `done` other than an answer or a reviewer change only records the result
+  (`check finished late`); if it is in progress with the same owner again, that
+  owner is asked to mark it done again. A check interrupted by a hub stop records
+  `check interrupted`, is not resumed, and the owner marks the task done again.

package/docs/specs/2026-09-20-durable-delivery-design.md

@@ -8,7 +8,7 @@ Target: 0.7.0, protocol 10
 
 Make ahub suitable for supervised daily development: expose disconnected recipients' pending work, survive daemon termination without silently losing accepted queued messages, and make uncertain execution an explicit operator decision. Publish an English operations guide and verify the release before applying it to the current installation.
 
-The user chose conservative recovery and deployment through production application. Never automatically replay uncertain or partially executed work. Exactly-once external effects, automatic rollback, and unattended native approval handling remain outside this release. Infrastructure prerequisites in issue #12 remain pending unless independently available; never manufacture quota exhaustion or disconnect the user's network.
+The user chose conservative recovery and deployment through production application. Never automatically replay uncertain or partially executed work. Exactly-once external effects, automatic rollback, and unattended native approval handling remain outside this release. Infrastructure prerequisites in issue #1 remain pending unless independently available; never manufacture quota exhaustion or disconnect the user's network.
 
 ## Delivery model
 

package/docs/specs/2026-09-20-upgrade-recovery-design.md

@@ -113,6 +113,12 @@ stopped with its matching CLI before a protocol-8 manager is launched.
 
 ## Current 0.7.0 correction and recovery contract
 
+Amended 2026-09-30: 0.7.0 shipped protocol 10 and the queue commands; protocol 10
+went into production with 0.7.0 and was verified there with 0.7.1, where
+`ahub queue list` read back live receipts ([smoke checklist](../smoke.md)). `ahub queue show` and `ahub queue resolve` are
+covered by tests, not by a live run. The paragraphs below keep the pre-release
+wording.
+
 The earlier sections record the protocol-8 implementation history. The current
 release is 0.6.4 with protocol 9; the next target is 0.7.0 with protocol 10.
 This correction supersedes the earlier protocol-8 source/target statement for
@@ -146,6 +152,6 @@ The documented verification sequence is: run a dry-run, verify package and
 session identity, manually confirm Claude recovery, read back version, session,
 queue, task, and budget state, then release the held queues. Do not claim a
 successful 0.7.0 cutover from tests, synthetic approvals, or package
-installation alone. Issue [#12](https://github.com/STAIxBWLB/agent-hub/issues/12)
+installation alone. Issue [#1](https://github.com/STAIxBWLB/agent-hub/issues/1)
 remains open for off-campus Access credentials and a natural near-limit budget
 pause.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@staix/agent-hub",
-  "version": "0.7.7",
+  "version": "0.7.8",
   "description": "Native multi-agent hub: Claude Code, Codex, Kimi Code, Pi and local inference as peers in one project",
   "license": "MIT",
   "type": "module",

package/plugins/agent-hub/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "agent-hub",
-  "version": "0.7.7",
+  "version": "0.7.8",
   "description": "Channel between Claude Code and the agent-hub daemon: peer messages from Codex, Kimi and the local worker arrive as channel events; hub_send replies.",
   "author": {
     "name": "Young Joon Lee",

package/plugins/agent-hub/server.js

@@ -15727,7 +15727,7 @@ class ControlClient {
 // package.json
 var package_default = {
   name: "@staix/agent-hub",
-  version: "0.7.7",
+  version: "0.7.8",
   description: "Native multi-agent hub: Claude Code, Codex, Kimi Code, Pi and local inference as peers in one project",
   license: "MIT",
   type: "module",
@@ -15806,7 +15806,7 @@ var TASK_TOOLS = [
   tool("hub_task_propose", "Put a piece of work on the shared task board. The hub assigns an owner by class (routing.toml) unless you name one. Classes: plan, implement, bulk_edit, test, review, summarize, triage. Name the class when you know it; without one the hub tries to pick it. Name yourself as owner to claim work nobody assigned you: it starts in progress. Put the paths the work touches in refs; the hub says when they overlap another open task.", { title: str, class: { type: "string", enum: ["plan", "implement", "bulk_edit", "test", "review", "summarize", "triage"] }, detail: str, refs, owner: { type: "string", description: "peer id; yours to claim the work, omit to let the hub route it" } }, ["title"]),
   tool("hub_task_accept", "Take a task that was assigned to you.", { id }, ["id"]),
   tool("hub_task_decline", "Pass on a task assigned to you; the hub offers it to the next peer.", { id, reason: str }, ["id"]),
-  tool("hub_task_done", "Mark your task finished. It goes to its reviewer with your summary and refs.", { id, summary: { type: "string", description: "what changed, why, and the check you ran with its result" }, refs }, ["id", "summary"]),
+  tool("hub_task_done", "Mark your task finished. It goes to its reviewer with your summary and refs. When the project configures a check for its class, the hub runs it first and the result comes as a task message: a failed check keeps the task with you.", { id, summary: { type: "string", description: "what changed, why, and the check you ran with its result" }, refs }, ["id", "summary"]),
   tool("hub_task_list", "The task board. PII tasks show as [pii].", { state: { type: "string", enum: ["proposed", "in_progress", "in_review", "approved", "changes_requested"] } }),
   tool("hub_review", "Give your verdict on a task you were asked to review. Two changes_requested in a row move the task to another peer.", { id, verdict: { type: "string", enum: ["approved", "changes_requested"] }, note: str }, ["id", "verdict"]),
   tool("hub_checkpoint", "Answer a checkpoint request from the hub (your quota window is nearly used up): what you were doing, what is half done, what whoever continues must know. Write the same to .agenthub/checkpoint.md first if you can.", { summary: str }, ["summary"]),

package/src/adapters/acp.ts

@@ -13,6 +13,8 @@ export interface PermissionRequest {
   peer: PeerId;
   title: string;
   options: PermissionOption[];
+  /** The tool's name alone, when the adapter knows it apart from the title (which can quote the payload). */
+  tool?: string;
 }
 
 export interface AcpOptions {
@@ -243,7 +245,17 @@ export class AcpPeer extends BasePeer {
     // An unknown payload is never dressed up as a description, and it must not buy a blanket grant.
     const title: string = raw === undefined ? `${call.title ?? "tool call"} (payload not reported by the agent)` : `${call.title ?? "tool call"}${input}`;
     const options: PermissionOption[] = (msg.params?.options ?? []).filter((o: PermissionOption) => (raw !== undefined && !cut) || o.kind !== "allow_always");
-    const picked = await this.opts.onPermission?.({ peer: this.id, title, options }).catch(() => undefined);
+    // Only a bare tool name travels on its own (a desktop notice shows it); anything prose-like stays in the title.
+    const tool = typeof call.title === "string" && /^[\w.:@-]{1,80}$/.test(call.title) ? call.title : undefined;
+    // Waiting for a person is not the agent going silent: keep the watchdog from cancelling the turn meanwhile.
+    const turn = this.turn;
+    const alive = setInterval(() => this.state === "busy" && turn === this.turn && this.touch(), Math.max(10, Math.min(30_000, Math.floor(this.watchdogMs / 3))));
+    let picked: string | undefined;
+    try {
+      picked = await this.opts.onPermission?.({ peer: this.id, title, options, ...(tool ? { tool } : {}) }).catch(() => undefined);
+    } finally {
+      clearInterval(alive); // also when there is no handler at all
+    }
     const valid = options.some((o) => o.optionId === picked);
     this.send({
       jsonrpc: "2.0",

package/src/adapters/codex-appserver.ts

@@ -1,6 +1,6 @@
 import { spawn, type ChildProcess } from "node:child_process";
 import type { Server, ServerWebSocket } from "bun";
-import { renderDigest, replyParent, type Envelope, type PeerId } from "../hub/envelope.ts";
+import { renderDigest, replyAudience, replyParent, type Envelope, type PeerId } from "../hub/envelope.ts";
 import { BasePeer } from "../hub/peers.ts";
 import { childEnv, stopOwnedProcess } from "../hub/child-process.ts";
 
@@ -54,6 +54,7 @@ export class CodexPeer extends BasePeer {
   private readonly pending = new Map<number, { resolve: (result?: any) => void; reject: (e: Error) => void; deliveryId?: string; kind?: "deliver" | "steer" }>();
   private usageTimer: ReturnType<typeof setInterval> | undefined;
   private injected: Envelope | undefined; // the hub envelope that started the current turn, if any
+  private answering: Envelope[] = []; // everything delivered or steered into the current turn: who its answer is for
   private lastAnswer = "";
   private readonly deltas = new Map<string, string[]>();
   private primed = false;
@@ -146,6 +147,7 @@ export class CodexPeer extends BasePeer {
         resolve: (result) => {
           this.primed = true;
           this.injected = replyParent(envs);
+          this.answering = [...envs];
           const nativeTurn = typeof result?.turn?.id === "string" ? result.turn.id : undefined;
           if (deliveryId) {
             if (nativeTurn) this.addTurnDelivery(nativeTurn, deliveryId);
@@ -188,6 +190,7 @@ export class CodexPeer extends BasePeer {
           this.primed = true;
           // The turn now answers these too; the highest hop wins so a steer cannot reset the hop cap.
           this.injected = replyParent(this.injected ? [this.injected, ...envs] : envs);
+          this.answering.push(...envs);
           if (deliveryId) {
             this.addTurnDelivery(expectedTurnId, deliveryId);
             this.delivery({ id: deliveryId, state: "accepted" });
@@ -216,6 +219,7 @@ export class CodexPeer extends BasePeer {
     for (const id of this.unboundDeliveries) this.delivery({ id, state: "needs_review", reason: "Codex turn watchdog timeout" });
     this.turnDeliveries.clear(); this.unboundDeliveries.clear();
     this.injected = undefined;
+    this.answering = [];
     this.lastAnswer = "";
     this.abandonSteers("turn went silent");
     super.onWatchdog();
@@ -297,9 +301,17 @@ export class CodexPeer extends BasePeer {
     for (const ids of this.turnDeliveries.values()) for (const id of ids) this.delivery({ id, state: "needs_review", reason: "Codex TUI detached" });
     for (const id of this.unboundDeliveries) this.delivery({ id, state: "needs_review", reason: "Codex TUI detached" });
     this.turnDeliveries.clear(); this.unboundDeliveries.clear();
+    this.forgetTurn();
     this.setState("offline");
   }
 
+  /** Nothing of an interrupted turn may address a later answer: a TUI that comes back starts its own. */
+  private forgetTurn(): void {
+    this.injected = undefined;
+    this.answering = [];
+    this.lastAnswer = "";
+  }
+
   private fromTui(link: Link, raw: string): void {
     const msg = parse(raw);
     if (msg?.id !== undefined && TRACKED.has(msg.method)) link.tracked.set(msg.id, msg.method);
@@ -329,6 +341,7 @@ export class CodexPeer extends BasePeer {
     this.link = link;
     this.threadId = threadId;
     this.activeTurns.clear();
+    this.forgetTurn();
     this.opts.log?.(`[${this.id}] thread ${threadId}`);
     this.setState("idle");
     this.readUsage();
@@ -385,11 +398,13 @@ export class CodexPeer extends BasePeer {
         this.turnDeliveries.delete(nativeTurn);
       }
       const inReplyTo = this.injected;
+      const to = replyAudience(this.answering);
       this.injected = undefined;
+      this.answering = [];
       this.deltas.clear();
-      // ponytail: the reply is addressed to the highest-hop sender only (newEnvelope's default). A digest that
-      // mixed senders answers the last of them; track the audience alongside `injected` if that starts to matter.
-      if (this.lastAnswer) this.onMessage?.(this.lastAnswer, inReplyTo ? { inReplyTo } : {});
+      // Addressed like every other adapter's answer (issue #3): each sender it answers, including one steered in;
+      // the bus maps a condensed delivery's `digest` back to the senders it replaced, a steer beside it or not.
+      if (this.lastAnswer) this.onMessage?.(this.lastAnswer, inReplyTo ? { inReplyTo, to } : {});
       this.lastAnswer = "";
       this.setState("idle");
     }

package/src/hub/bus.ts

@@ -130,9 +130,12 @@ export class Bus {
       const last = this.lastDelivery.get(peer.id);
       const answers = opts?.inReplyTo?.id !== undefined && last?.out.some((e) => e.id === opts.inReplyTo!.id);
       const originals = answers ? last!.originals : undefined;
+      // `digest` in the audience stands for the condensed delivery even when a steer, not the digest, is the parent.
+      const condensed = !!last?.out.some((e) => e.from === DIGEST);
+      const audienceOriginals = originals ?? (opts?.to?.includes(DIGEST) && condensed ? last?.originals : undefined);
       this.publish(newEnvelope(peer.id, body, {
         ...opts,
-        ...(opts?.to?.length ? { to: resolveTo(opts.to, originals) } : {}),
+        ...(opts?.to?.length ? { to: resolveTo(opts.to, audienceOriginals) } : {}),
         priority: opts?.priority ?? capPriority(peer, priority, opts?.inReplyTo, originals),
       }));
     };
@@ -387,6 +390,11 @@ export class Bus {
     return () => this.taps.delete(fn);
   }
 
+  /** Paused by the console or the budget relay, whatever the adapter's own state. */
+  isPaused(id: PeerId): boolean {
+    return this.paused.has(id);
+  }
+
   /** The adapter's state, or `paused` while the peer is held by `pause()`. */
   stateOf(id: PeerId): PeerState {
     const state = this.peers.get(id)?.state ?? "offline";

package/src/hub/checks.ts

@@ -0,0 +1,91 @@
+import { spawn, spawnSync } from "node:child_process";
+import { childEnv } from "./child-process.ts";
+
+export interface CheckResult {
+  code: number | null;
+  timedOut: boolean;
+  /** Killed because the hub stopped: not a verdict on the work. */
+  interrupted?: boolean;
+  /** The last lines of stdout and stderr together, capped. */
+  tail: string;
+}
+
+const TAIL_LINES = 40;
+const TAIL_CHARS = 4000;
+const KEEP_CHARS = 64 * 1024;
+/** How long output may still arrive after the command exited; a descendant that left the group can hold the pipes. */
+const DRAIN_MS = 500;
+
+/**
+ * Why the completion checks of issue #7 must not run, or undefined when git confirms nobody committed the config.
+ * A command a cloned repository ships would otherwise run on the owner's machine the first time an agent marks a task
+ * done. Unknown is not untracked: no repository, no git, or a git error all refuse. The directory itself counts too (a
+ * committed symlink or submodule at `.agenthub`), and so does any spelling of the path, since macOS opens either.
+ */
+export function checksRefusal(cwd: string): string | undefined {
+  const r = spawnSync("git", ["-C", cwd, "ls-files", "-s", "-z", "--", ":(icase).agenthub"], { encoding: "utf8", env: childEnv(process.env) });
+  if (r.status !== 0) return "git could not confirm that .agenthub/config.json is untracked";
+  const tracked = r.stdout.split("\0").some((row) => {
+    const path = row.slice(row.indexOf("\t") + 1).toLowerCase();
+    return path === ".agenthub" || path === ".agenthub/config.json";
+  });
+  return tracked ? ".agenthub/config.json is committed to git" : undefined;
+}
+
+/** Runs one check command in the project root, in its own process group so a timeout stops what it started. */
+export function runCheck(command: string, cwd: string, timeoutMs: number, running?: Set<() => void>): Promise<CheckResult> {
+  return new Promise((resolve) => {
+    let out = "";
+    let timedOut = false;
+    let interrupted = false;
+    let settled = false;
+    let exited = false;
+    const child = spawn("sh", ["-c", command], { cwd, env: childEnv(process.env), stdio: ["ignore", "pipe", "pipe"], detached: true });
+    const killGroup = () => {
+      try {
+        if (child.pid) process.kill(-child.pid, "SIGKILL");
+      } catch {
+        // already gone
+      }
+    };
+    const stop = () => {
+      if (exited) return; // finished before the hub stopped: its own result stands
+      interrupted = true;
+      killGroup();
+    };
+    running?.add(stop);
+    const keep = (chunk: string) => {
+      out += chunk;
+      if (out.length > KEEP_CHARS) out = out.slice(-KEEP_CHARS);
+    };
+    for (const s of [child.stdout, child.stderr]) {
+      s?.setEncoding("utf8"); // decodes across chunk edges, so Korean output is not cut into U+FFFD
+      s?.on("data", keep);
+    }
+    const timer = setTimeout(() => {
+      timedOut = true;
+      killGroup();
+    }, timeoutMs);
+    const done = (code: number | null) => {
+      if (settled) return;
+      settled = true;
+      clearTimeout(timer);
+      running?.delete(stop);
+      child.stdout?.destroy();
+      child.stderr?.destroy();
+      const tail = out.replace(/\s+$/, "").split("\n").slice(-TAIL_LINES).join("\n").slice(-TAIL_CHARS);
+      resolve({ code: timedOut || interrupted ? null : code, timedOut, ...(interrupted ? { interrupted } : {}), tail });
+    };
+    child.on("error", (e) => {
+      out += `\n${e.message}`;
+      done(null);
+    });
+    child.on("exit", (code) => {
+      exited = true;
+      clearTimeout(timer); // it finished in time; only its output may still be on the way
+      killGroup(); // a background job it left behind (sh has no job control, so it is still in the group)
+      setTimeout(() => done(code), DRAIN_MS);
+    });
+    child.on("close", (code) => done(code));
+  });
+}

package/src/hub/daemon.ts

@@ -2,6 +2,9 @@ import { createHash, randomBytes, randomUUID } from "node:crypto";
 import { appendFileSync, chmodSync, existsSync, mkdirSync, readFileSync, renameSync, rmSync, writeFileSync } from "node:fs";
 import { join, resolve } from "node:path";
 import { homedir } from "node:os";
+import { spawn } from "node:child_process";
+import { childEnv } from "./child-process.ts";
+import { checksRefusal, runCheck } from "./checks.ts";
 import type { ServerWebSocket } from "bun";
 import { AcpPeer, type PermissionRequest } from "../adapters/acp.ts";
 import { CodexPeer } from "../adapters/codex-appserver.ts";
@@ -16,7 +19,7 @@ import { Capture, skipTools } from "../memory/capture.ts";
 import { DEFAULT_OMNIROUTE, OmniRoute, type OmniRouteConfig } from "../omniroute/client.ts";
 import { Sidecar } from "../switchyard/sidecar.ts";
 import { Briefs } from "../memory/brief.ts";
-import { Board, type TaskClass } from "./board.ts";
+import { Board, CLASSES, type TaskClass } from "./board.ts";
 import { Budget, claudeWindows, codexWindows, DEFAULT_BUDGET, type BudgetConfig } from "./budget.ts";
 import { HUB } from "./envelope.ts";
 import { trimToTokens } from "../memory/recall.ts";
@@ -53,6 +56,12 @@ export interface HubConfig {
   pi: { enabled: boolean; auto_start: boolean; cmd: string[]; backend: "auto" | "dgx" | "mlx"; dgx_coding: string; dgx_fast: string; max_steps: number };
   mlx: Pick<MlxOptions, "provider" | "host" | "runtimeDir" | "modelPath" | "port" | "model" | "sourceModel" | "contextWindow" | "maxInputTokens" | "maxTokens" | "maxConcurrency">;
   local: { deny: string[]; bash_network: boolean; max_steps: number; read_allow: string[] };
+  /** Pending permission requests: how long they wait, and whether the desktop is told (issue #5). */
+  approvals: { timeout_s: number; notify: boolean };
+  /** An owner offline this long loses its open tasks back to routing; 0 turns it off (issue #6). */
+  tasks: { release_after_min: number };
+  /** A command per task class run when the owner marks the task done, and its timeout (issue #7). */
+  checks: { timeout_s: number; [cls: string]: string | number };
 }
 export const DEFAULT_CONFIG: HubConfig = {
   watchdog_ms: DEFAULT_WATCHDOG_MS,
@@ -69,6 +78,10 @@ export const DEFAULT_CONFIG: HubConfig = {
   pi: { enabled: false, auto_start: false, cmd: ["pi"], backend: "auto", dgx_coding: "coding", dgx_fast: "fast", max_steps: 30 },
   mlx: { provider: "ollama", model: "agenthub-fast-mlx:4b-8k", sourceModel: "qwen3.5:4b-mlx", contextWindow: 8192, maxInputTokens: 6000, maxTokens: 2048, maxConcurrency: 1 },
   local: { deny: [], bash_network: false, max_steps: 30, read_allow: [] },
+  // Off here, so tests and a hub without a config file stay silent; a project's config defaults it on for macOS.
+  approvals: { timeout_s: 120, notify: false },
+  tasks: { release_after_min: 30 },
+  checks: { timeout_s: 600 },
 };
 
 export { stateDirFor };
@@ -98,6 +111,12 @@ export function loadConfig(cwd: string): HubConfig {
       omniroute: { ...DEFAULT_CONFIG.omniroute, ...file.omniroute },
       local: { ...DEFAULT_CONFIG.local, ...file.local },
       pi: { ...DEFAULT_CONFIG.pi, ...file.pi },
+      approvals: {
+        timeout_s: file.approvals?.timeout_s ?? DEFAULT_CONFIG.approvals.timeout_s,
+        notify: typeof file.approvals?.notify === "boolean" ? file.approvals.notify : process.platform === "darwin",
+      },
+      tasks: { ...DEFAULT_CONFIG.tasks, ...file.tasks },
+      checks: { ...DEFAULT_CONFIG.checks, ...file.checks },
       mlx,
     };
   } catch (error) {
@@ -121,6 +140,8 @@ export interface DaemonOptions {
   /** Auto-approve ACP permission requests with the agent's allow_once option. */
   unattended?: boolean;
   permissionTimeoutMs?: number;
+  /** Tests replace the desktop notifier; the default posts a macOS notification when approvals.notify is on. */
+  notifier?: (title: string, body: string) => void;
   /** Called once when shutdown begins, however it was triggered; the lifecycle uses it to arm a hard deadline. */
   onShutdownStart?: () => void;
   /** How often the daemon checks that its project root and state dir still exist. Tests shrink this. */
@@ -301,6 +322,17 @@ export async function startDaemon(opts: DaemonOptions) {
   };
   const board = new Board(join(opts.stateDir, "hub.db"));
   startupCleanup.push(() => board.close());
+  // Completion checks (issue #7): only from a config file git does not track, one at a time, killed on stop.
+  const checkCommands = Object.fromEntries(Object.entries(config.checks).filter(([k, v]) => (CLASSES as readonly string[]).includes(k) && typeof v === "string" && v.trim())) as Record<string, string>;
+  const strayChecks = Object.keys(config.checks).filter((k) => k !== "timeout_s" && !(k in checkCommands));
+  if (strayChecks.length) log(`checks ignored for ${strayChecks.join(", ")}: not a task class with a command (classes: ${CLASSES.join(", ")})`);
+  const checksRefused = Object.keys(checkCommands).length ? checksRefusal(opts.cwd) : undefined;
+  if (checksRefused) log(`checks ignored: ${checksRefused}, and only a file nobody committed may choose commands the hub runs`);
+  const checksAllowed = Object.keys(checkCommands).length > 0 && !checksRefused;
+  const checkTimeoutS = typeof config.checks.timeout_s === "number" && config.checks.timeout_s >= 1 ? Math.min(config.checks.timeout_s, 3600) : 600;
+  const runningChecks = new Set<() => void>();
+  let checksClosed = false; // set on stop: a check still queued then must not start and outlive the hub
+  const interrupted = { code: null, timedOut: false, interrupted: true, tail: "" };
   const tasks = new Tasks({
     board,
     bus,
@@ -309,6 +341,7 @@ export async function startDaemon(opts: DaemonOptions) {
     project: chain.at(-1)!,
     ...(config.memory.enabled ? { memory, briefs: new Briefs(memory, chain.at(-1)!, config.memory.brief_items) } : {}),
     notify,
+    ...(checksAllowed ? { check: (cls: string) => checkCommands[cls], runCheck: async (command: string) => (checksClosed ? interrupted : runCheck(command, opts.cwd, checkTimeoutS * 1000, runningChecks)) } : {}),
     // What a peer learned reaches the peers working now, on their next delivery, instead of at their next session (#68).
     // Fail-open: the note is already saved, so a bus that cannot persist costs the sharing, not the tool call.
     share: (by, line) => {
@@ -318,6 +351,13 @@ export async function startDaemon(opts: DaemonOptions) {
         log(`note from ${by} not shared: ${(e as Error).message}`);
       }
     },
+    tell: (peer, line) => {
+      try {
+        bus.note(peer, line);
+      } catch (e) {
+        log(`note for ${peer} not kept: ${(e as Error).message}`);
+      }
+    },
     triage: { classify: (title, detail) => inference?.triage(title, detail) ?? Promise.resolve(undefined), onCampus: () => onCampus() },
   });
   // ---- budget relay -------------------------------------------------------------------------------------------
@@ -435,8 +475,10 @@ export async function startDaemon(opts: DaemonOptions) {
         return line(tasks.accept(by, a.id));
       case "hub_task_decline":
         return line(await tasks.decline(by, a.id, a.reason));
-      case "hub_task_done":
-        return line(await tasks.done(by, a.id, a.summary, a.refs));
+      case "hub_task_done": {
+        const t = await tasks.done(by, a.id, a.summary, a.refs);
+        return tasks.isChecking(t.id) ? `${line(t)}; its check is queued or running, and the result comes as a task message` : line(t);
+      }
       case "hub_review":
         return line(await tasks.review(by, a.id, a.verdict, a.note));
       case "hub_remember":
@@ -481,8 +523,9 @@ export async function startDaemon(opts: DaemonOptions) {
     const r = budget.record(id); // one read per peer: status.json is rewritten on every bus event
     return r ? { paused: `budget: ${r.reason}, resets ${new Date(r.resetsAt).toLocaleTimeString()}` } : manualPaused.has(id) && bus.stateOf(id) === "offline" ? { paused: "manual" } : {};
   };
+  let releasing = false; // gone-owner release (#6): one run at a time, and a recovery commit waits for it
   const recoveryReady = () => {
-    if (!recoveryActive() || (piReceipts?.inFlight ?? 0) !== 0 || permissions.size !== 0 || starting.size !== 0 || !budget.recoverySettled || [...bus.peers.values()].some((peer) => peer.state === "busy" || (peer instanceof PiPeer && !peer.recoveryReady))) return false;
+    if (!recoveryActive() || releasing || (piReceipts?.inFlight ?? 0) !== 0 || permissions.size !== 0 || starting.size !== 0 || !budget.recoverySettled || [...bus.peers.values()].some((peer) => peer.state === "busy" || (peer instanceof PiPeer && !peer.recoveryReady))) return false;
     if (!recoveryPeerSnapshot) return true;
     const current = recoveryPeers();
     return recoveryPeerSnapshot.every((saved) => {
@@ -577,17 +620,70 @@ export async function startDaemon(opts: DaemonOptions) {
   // message and keeps a phantom `queued N` after the queue drains (measured on a live 0.6.3 hub).
   bus.onQueues = () => { if (!stopping) writeStatus(); };
 
+  // When each peer went offline; a peer never seen attached counts from hub start (issue #6).
+  const offlineSince = new Map<PeerId, number>();
+  const hubStartedAt = Date.now();
+  const releaseGoneOwners = async () => {
+    const limit = config.tasks.release_after_min;
+    if (!(limit > 0) || releasing || stopping || recoveryActive()) return;
+    releasing = true;
+    try {
+      await releaseOwners(limit);
+    } finally {
+      releasing = false;
+    }
+  };
+  const releaseOwners = async (limit: number) => {
+    const owners = new Set(board.list().filter((t) => t.owner && ["proposed", "in_progress", "changes_requested"].includes(t.state)).map((t) => t.owner!));
+    for (const owner of owners) {
+      if (stopping || recoveryActive()) return;
+      if (owner === USER || owner === "hub" || bus.isPaused(owner) || bus.stateOf(owner) !== "offline") continue;
+      const since = offlineSince.get(owner) ?? hubStartedAt;
+      if (Date.now() - since < limit * 60_000) continue;
+      const moved = await tasks.releaseFromGone(owner, Math.round((Date.now() - since) / 60_000)).catch((e) => (log(`releasing tasks of ${owner} failed: ${(e as Error).message}`), []));
+      for (const m of moved) notify(`task ${m.title} moved from ${owner} (offline) to ${m.to ?? "nobody"}`);
+    }
+  };
+  const releaseTimer = setInterval(() => void releaseGoneOwners(), 60_000);
+  releaseTimer.unref?.();
+  intervals.push(releaseTimer);
+
   bus.tap((e) => {
     e = redact(e);
     uiEvents.push({ seq: ++uiSequence, event: e });
     if (uiEvents.length > 200) uiEvents.shift();
-    if (e.t === "state") log(`state ${e.peer} -> ${e.state}`);
+    if (e.t === "state") {
+      log(`state ${e.peer} -> ${e.state}`);
+      if (e.state === "offline") offlineSince.set(e.peer, offlineSince.get(e.peer) ?? Date.now());
+      else offlineSince.delete(e.peer);
+    }
     else if (e.t === "undeliverable") log(`UNDELIVERABLE to ${e.peer} after retries: ${e.env.id} from ${e.env.from}`);
     else if (e.t === "overflow") log(`OVERFLOW ${e.peer}: dropped ${e.env.id} from ${e.env.from}`);
     else log(`msg ${e.env.from} -> ${e.env.to?.join(",") ?? "*"} ${e.env.priority} hop=${e.env.hop}${e.dropped ? ` NOT DELIVERED(${e.dropped})` : ""}: ${e.env.body.slice(0, 200)}`);
     if (!stopping) writeStatus();
   });
 
+  const approvalTimeoutS = (() => {
+    const s = config.approvals.timeout_s;
+    if (typeof s === "number" && s >= 30 && s <= 3600) return s;
+    log(`approvals.timeout_s ${JSON.stringify(s)} is outside 30-3600 seconds; using 120`);
+    return 120;
+  })();
+  let notifierBroken = false;
+  // Peer and tool name only: a title can quote what a PII turn is about to write (issue #5).
+  const desktop = opts.notifier ?? ((title: string, body: string) => {
+    const quote = (t: string) => `"${t.replace(/[\\"]/g, "\\$&")}"`;
+    const child = spawn("osascript", ["-e", `display notification ${quote(body)} with title ${quote(title)}`], { stdio: "ignore", env: childEnv(process.env) });
+    const kill = setTimeout(() => child.kill(), 5000);
+    kill.unref?.();
+    const failed = (why: string) => {
+      if (!notifierBroken) log(`desktop notification failed (${why}); later ones are not reported`);
+      notifierBroken = true;
+    };
+    child.on("error", (e: Error) => (clearTimeout(kill), failed(e.message)));
+    child.on("exit", (code: number | null, signal: string | null) => (clearTimeout(kill), code || signal ? failed(signal ? `osascript stopped by ${signal}` : `osascript exit ${code}`) : undefined));
+  });
+
   async function onPermission(req: PermissionRequest): Promise<string | undefined> {
     if (stopping) return undefined;
     if (opts.unattended) return req.options.find((o) => o.kind === "allow_once")?.optionId;
@@ -597,11 +693,24 @@ export async function startDaemon(opts: DaemonOptions) {
     const title = req.title.replace(/[\u0000-\u0008\u000b-\u001f\u007f-\u009f]/g, (c) => `\\x${c.charCodeAt(0).toString(16).padStart(2, "0")}`);
     // The title can quote what a PII turn is about to write. It is for the person approving, on the console; the log
     // (which `ahub ask` reads as evidence) only records that a request was made.
-    log(`permission ${id} requested by ${req.peer} (${title.length} chars, shown on the console)`);
-    const push = JSON.stringify({ t: "permission", id, ...req, title });
+    const timeoutMs = opts.permissionTimeoutMs ?? approvalTimeoutS * 1000;
+    log(`permission ${id} requested by ${req.peer} (${title.length} chars, shown on the console; cancelled after ${timeoutMs / 1000}s)`);
+    // The tool name is for the desktop notice only: the console push keeps its shape.
+    const { tool: _tool, ...shown } = req;
+    const push = JSON.stringify({ t: "permission", id, ...shown, title });
     for (const c of consoles) if (c.data.tail) c.send(push);
+    if (config.approvals.notify) {
+      try {
+        desktop("agent-hub", `${req.peer} asks for approval${req.tool ? `: ${req.tool}` : ""} (ahub tail)`);
+      } catch {
+        // never let a notifier break the request itself
+      }
+    }
     return new Promise((resolve) => {
-      const timer = setTimeout(() => done(undefined), opts.permissionTimeoutMs ?? 120_000);
+      const timer = setTimeout(() => {
+        notify(`permission ${id} from ${req.peer} was not answered within ${Math.round(timeoutMs / 1000)}s and was cancelled`);
+        done(undefined);
+      }, timeoutMs);
       const done = (optionId: string | undefined) => {
         clearTimeout(timer);
         permissions.delete(id);
@@ -1278,6 +1387,8 @@ export async function startDaemon(opts: DaemonOptions) {
   }
   async function stopOnce(): Promise<void> {
     stopping = true;
+    checksClosed = true;
+    for (const kill of runningChecks) kill();
     log("hub stopping");
     writeStatus();
     dashboard?.stop();

package/src/hub/hub-tools.ts

@@ -26,7 +26,7 @@ export const TASK_TOOLS: HubTool[] = [
   tool("hub_task_propose", "Put a piece of work on the shared task board. The hub assigns an owner by class (routing.toml) unless you name one. Classes: plan, implement, bulk_edit, test, review, summarize, triage. Name the class when you know it; without one the hub tries to pick it. Name yourself as owner to claim work nobody assigned you: it starts in progress. Put the paths the work touches in refs; the hub says when they overlap another open task.", { title: str, class: { type: "string", enum: ["plan", "implement", "bulk_edit", "test", "review", "summarize", "triage"] }, detail: str, refs, owner: { type: "string", description: "peer id; yours to claim the work, omit to let the hub route it" } }, ["title"]),
   tool("hub_task_accept", "Take a task that was assigned to you.", { id }, ["id"]),
   tool("hub_task_decline", "Pass on a task assigned to you; the hub offers it to the next peer.", { id, reason: str }, ["id"]),
-  tool("hub_task_done", "Mark your task finished. It goes to its reviewer with your summary and refs.", { id, summary: { type: "string", description: "what changed, why, and the check you ran with its result" }, refs }, ["id", "summary"]),
+  tool("hub_task_done", "Mark your task finished. It goes to its reviewer with your summary and refs. When the project configures a check for its class, the hub runs it first and the result comes as a task message: a failed check keeps the task with you.", { id, summary: { type: "string", description: "what changed, why, and the check you ran with its result" }, refs }, ["id", "summary"]),
   tool("hub_task_list", "The task board. PII tasks show as [pii].", { state: { type: "string", enum: ["proposed", "in_progress", "in_review", "approved", "changes_requested"] } }),
   tool("hub_review", "Give your verdict on a task you were asked to review. Two changes_requested in a row move the task to another peer.", { id, verdict: { type: "string", enum: ["approved", "changes_requested"] }, note: str }, ["id", "verdict"]),
   tool("hub_checkpoint", "Answer a checkpoint request from the hub (your quota window is nearly used up): what you were doing, what is half done, what whoever continues must know. Write the same to .agenthub/checkpoint.md first if you can.", { summary: str }, ["summary"]),

package/src/hub/tasks.ts

@@ -15,14 +15,22 @@ export interface TasksDeps {
   memory?: MemoryClient;
   /** a line for the human: console tail and hub.log */
   notify: (line: string) => void;
+  /** The completion check configured for a class, if any (local config only; issue #7). */
+  check?: (cls: TaskClass) => string | undefined;
+  /** Runs one check; the hub runs them one at a time. */
+  runCheck?: (command: string) => Promise<{ code: number | null; timedOut: boolean; interrupted?: boolean; tail: string }>;
   /** Hands a saved note to every other peer; it rides on their next delivery. */
   share?: (by: PeerId, line: string) => void;
+  /** Hands one peer a line that rides on its next delivery, without a turn of its own (issue #6). */
+  tell?: (peer: PeerId, line: string) => void;
   /** Optional: name a class for a task proposed without one. `onCampus` says whether the model call stays on campus. */
   triage?: { classify: (title: string, detail: string) => Promise<TaskClass | undefined>; onCampus: () => Promise<boolean> };
 }
 
 const ESCALATE_AFTER = 2;
 const OPEN: Task["state"][] = ["proposed", "in_progress", "changes_requested"];
+/** Board events that leave a task where its completion check found it; any other event means it moved on meanwhile. */
+const QUIET_EVENTS = new Set(["answer", "reviewer changed"]);
 
 /** Same path, or one is a directory of the other; the project root (`.`) holds everything. */
 const samePlace = (a: string, b: string) => {
@@ -90,10 +98,14 @@ export class Tasks {
       if (!pii || (await this.d.triage.onCampus().catch(() => false))) cls = await this.d.triage.classify(text.title, text.detail).catch(() => undefined);
       triaged = !!cls;
     }
+    // A claim is work the caller will do itself: without a class and a model to name one, it is implementation (#6).
+    const defaulted = !cls && input.owner === by;
+    if (defaulted) cls = "implement";
     if (!cls) throw new Error(`class is required (one of ${CLASSES.join(", ")}); the hub could not name one for you`);
     const draft = { ...text, class: cls };
     let task = this.d.board.propose(by, { ...draft, signals });
     if (triaged) task = this.d.board.update(task.id, "hub", "triaged", {}, `class ${cls} named by the hub's model`);
+    if (defaulted) task = this.d.board.update(task.id, "hub", "class defaulted", {}, "class implement for a claim without one");
     this.d.notify(`task ${this.publicTitle(task)} proposed by ${by} [${task.class}]${task.signals.length ? ` signals: ${task.signals.join(", ")}` : ""}`);
     // Naming yourself is a claim: the work is already yours, so no offer comes back to you (paper: Agensh CLAIM, #68).
     return this.assignOwner(task, by, input.owner ? { candidates: [input.owner], claim: input.owner === by } : {});
@@ -105,18 +117,65 @@ export class Tasks {
    * sides: their refs are hidden from cloud peers.
    */
   overlaps(task: Task, forOwner = true): string {
-    const mine = task.refs.paths ?? [];
-    if (!mine.length || this.isPii(task)) return "";
-    const hits = this.d.board.list().flatMap((t) => {
-      if (t.id === task.id || !t.owner || t.owner === task.owner || !OPEN.includes(t.state) || this.isPii(t)) return [];
-      const shared = mine.filter((p) => (t.refs.paths ?? []).some((q) => samePlace(p, q)));
-      return shared.length ? [`#${t.id} (owner ${t.owner}) on ${shared.join(", ")}`] : [];
-    });
+    const hits = this.overlapHits(task).map((h) => `#${h.task.id} (owner ${h.task.owner}) on ${h.paths.join(", ")}`);
     if (!hits.length) return "";
     const who = forOwner ? "Settle it with that owner via hub_send before editing those paths." : `${task.owner ?? "Whoever takes it"} is told to settle it.`;
     return `Overlaps ${hits.join("; ")}. ${who}`;
   }
 
+  /** While a gone owner's tasks move, its other tasks are about to move too: they are no one to settle with. */
+  private releasing: PeerId | undefined;
+
+  private overlapHits(task: Task): { task: Task; paths: string[] }[] {
+    const mine = task.refs.paths ?? [];
+    if (!mine.length || this.isPii(task)) return [];
+    return this.d.board.list().flatMap((t) => {
+      if (t.id === task.id || !t.owner || t.owner === task.owner || t.owner === this.releasing || !OPEN.includes(t.state) || this.isPii(t)) return [];
+      const paths = mine.filter((p) => (t.refs.paths ?? []).some((q) => samePlace(p, q)));
+      return paths.length ? [{ task: t, paths }] : [];
+    });
+  }
+
+  /** The earlier owner hears of an overlap on its next delivery, costing it no turn; the newcomer settles it (#6). */
+  private tellEarlierOwners(task: Task): void {
+    if (!task.owner || !this.d.tell) return;
+    for (const hit of this.overlapHits(task)) {
+      if (hit.task.owner === USER || hit.task.owner === HUB) continue;
+      this.d.tell(hit.task.owner!, noteLine(HUB, "finding", `task #${task.id} (owner ${task.owner}) now overlaps your #${hit.task.id} on ${hit.paths.join(", ")}; ${task.owner} is told to settle it`));
+    }
+  }
+
+  /**
+   * An owner offline past the limit loses its open tasks back to routing, through the same path a budget pause uses.
+   * Only when some other peer can take a task: with nobody to hand it to, it stays with its owner.
+   */
+  async releaseFromGone(peer: PeerId, minutes: number): Promise<{ id: number; title: string; to: PeerId | null }[]> {
+    const moved: { id: number; title: string; to: PeerId | null }[] = [];
+    const why = `owner ${peer} offline for ${minutes} min`;
+    const ids = this.d.board.list().filter((t) => t.owner === peer && OPEN.includes(t.state)).map((t) => t.id);
+    this.releasing = peer;
+    try {
+      for (const id of ids) {
+        // Awaits run between tasks (briefs, memory): re-read, and stop for anything that changed meanwhile.
+        const task = this.d.board.get(id);
+        if (!task || task.owner !== peer || !OPEN.includes(task.state) || this.d.bus.stateOf(peer) !== "offline") continue;
+        if (!assign(task, this.states(), this.d.routing(), { exclude: [...this.declined(task), peer] }).owner) continue;
+        try {
+          const back = task.state === "in_progress" ? this.d.board.update(task.id, HUB, "released", { state: "proposed" }, why) : task;
+          const next = await this.assignOwner(back, HUB, { exclude: [peer], event: "reassigned", note: why });
+          moved.push({ id: task.id, title: this.publicTitle(task), to: next.owner });
+          // The gone owner hears it on its next delivery, if it comes back mid-work.
+          if (next.owner && next.owner !== peer) this.d.tell?.(peer, noteLine(HUB, "decision", `task #${task.id} moved to ${next.owner} while you were offline; stop working on it`));
+        } catch (e) {
+          this.d.notify(`task ${this.publicTitle(task)}: could not be released from ${peer}: ${(e as Error).message}`);
+        }
+      }
+    } finally {
+      this.releasing = undefined;
+    }
+    return moved;
+  }
+
   /** Same code as assignment, without doing it. */
   explain(target: number | { title: string; detail?: string; class: TaskClass; refs?: TaskRefs }): string[] {
     const routing = this.d.routing();
@@ -140,7 +199,10 @@ export class Tasks {
     }
     const next = this.d.board.update(task.id, by, opts.event ?? "assigned", { owner: a.owner, reviewer: a.reviewer ?? null, ...(opts.event === "escalated" ? { rejections: 0 } : {}) }, opts.note ?? `to ${a.owner}`);
     const overlap = this.overlaps(next, false);
-    if (overlap) this.d.notify(`task ${this.publicTitle(next)} (${next.owner}): ${overlap}`);
+    if (overlap) {
+      this.d.notify(`task ${this.publicTitle(next)} (${next.owner}): ${overlap}`);
+      this.tellEarlierOwners(next);
+    }
     if (opts.claim && a.owner === by) {
       const claimed = this.d.board.update(next.id, by, "accepted", { state: "in_progress" });
       this.d.notify(`task ${this.publicTitle(claimed)} claimed by ${by}`);
@@ -197,13 +259,64 @@ export class Tasks {
     return this.assignOwner(back, HUB, { event: "reassigned", clearOnFail: true });
   }
 
+  /** Tasks whose check is queued or running, and the owner it was started for. */
+  private readonly checking = new Map<number, PeerId | null>();
+  private checkQueue: Promise<void> = Promise.resolve();
+
+  /** Whether a completion check is still running for this task. */
+  isChecking = (id: number) => this.checking.has(id);
+
   async done(by: PeerId, id: unknown, summary?: string, refs?: TaskRefs): Promise<Task> {
     let task = this.need(id);
     this.mine(task, by, "owner");
     if (task.state === "in_review" || task.state === "approved") throw new Error(`task #${task.id} is already ${task.state}`);
+    if (this.checking.has(task.id)) {
+      // The result goes only to the owner the check was started for: anyone who took the task since hears nothing.
+      throw new Error(this.checking.get(task.id) === task.owner ? `task #${task.id}: its check is still running; its result comes as a task message` : `task #${task.id}: a check from before it changed hands is still running; call hub_task_done again in a few minutes`);
+    }
     if (task.state === "proposed" || task.state === "changes_requested") task = this.d.board.update(task.id, by, "accepted", { state: "in_progress" }); // done without a separate accept
+    const command = this.d.runCheck ? this.d.check?.(task.class) : undefined;
+    if (!command) return this.complete(task, by, summary, refs);
+    // The tool call returns now; a check can outlast an agent's tool timeout. The result decides what comes next.
+    this.checking.set(task.id, task.owner);
+    const pending = this.d.board.update(task.id, by, "done (checking)", { refs: cleanRefs(refs) }, summary);
+    this.d.notify(`task ${this.publicTitle(pending)} done by ${by}; its check is queued or running: ${command}`);
+    const seen = { events: pending.history.length, owner: pending.owner };
+    this.checkQueue = this.checkQueue
+      .then(() => this.finishChecked(pending.id, by, summary, command, seen))
+      .catch((e: Error) => this.d.notify(`task #${pending.id}: its check result could not be recorded: ${e.message}`));
+    return pending;
+  }
+
+  private async finishChecked(id: number, by: PeerId, summary: string | undefined, command: string, seen: { events: number; owner: PeerId | null }): Promise<void> {
+    const result = await this.d.runCheck!(command).catch((e: Error) => ({ code: null, timedOut: false, interrupted: false, tail: e.message }));
+    this.checking.delete(id);
+    const task = this.d.board.get(id);
+    if (!task) return;
+    const outcome = `${command} -> ${result.interrupted ? "interrupted by a hub stop" : result.timedOut ? "timed out" : `exit ${result.code ?? "?"}`}`;
+    // Not a verdict on the work, and nobody is listening any more: the owner marks the task done again (spec).
+    if (result.interrupted) return void this.d.board.update(id, HUB, "check interrupted", {}, outcome);
+    const pii = this.isPii(task);
+    // Moved on meanwhile (escalated, reassigned, released, and maybe back again): the result is kept, nothing else changes.
+    if (task.state !== "in_progress" || task.history.slice(seen.events).some((h) => !QUIET_EVENTS.has(h.event))) {
+      this.d.board.update(id, HUB, "check finished late", {}, outcome);
+      if (task.state === "in_progress" && task.owner === seen.owner) this.tell(task, `Task #${id}: the check of your earlier hub_task_done finished after the task changed hands (${outcome}). Call hub_task_done again when it is ready.`, pii);
+      return;
+    }
+    if (result.code === 0 && !result.timedOut) {
+      this.d.board.update(id, HUB, "check passed", {}, `${outcome}\n${result.tail}`.trim());
+      // The output goes to the reviewer with the done note, not into shared memory: nobody screened it.
+      await this.complete(this.d.board.get(id)!, by, `${summary ?? ""}\nCheck: ${outcome}`.trim(), undefined, result.tail);
+      return;
+    }
+    this.d.board.update(id, HUB, "check failed", {}, `${outcome}\n${result.tail}`.trim());
+    this.d.notify(`task ${this.publicTitle(task)}: its check failed (${outcome}); it stays with ${task.owner ?? by}`);
+    this.tell(task, `Task #${id}: its check failed.\n$ ${outcome}${result.tail ? `\n${result.tail}` : ""}\nFix it and call hub_task_done again.`, pii);
+  }
+
+  private async complete(task: Task, by: PeerId, summary?: string, refs?: TaskRefs, checkOutput = ""): Promise<Task> {
     const reviewer = task.reviewer;
-    const next = this.d.board.update(task.id, by, "done", { state: reviewer ? "in_review" : "approved", refs: cleanRefs(refs) }, summary);
+    const next = this.d.board.update(task.id, by, "done", { state: reviewer ? "in_review" : "approved", refs: cleanRefs(refs) }, checkOutput ? `${summary ?? ""}\n${checkOutput}`.trim() : summary);
     this.note(next, by, "finding", `Task #${next.id} done by ${by}: ${next.title}\n${summary ?? ""}`);
     if (!reviewer) this.d.notify(`task ${this.publicTitle(next)} done by ${by}, no reviewer: approved`);
     else if (reviewer === USER) this.d.notify(`task ${this.publicTitle(next)} done by ${by}: review it with ahub task show ${next.id}, then ahub review ${next.id} approved|changes_requested [note]`);

package/templates/config.json

@@ -23,5 +23,8 @@
     "cf_client_id_file": "",
     "cf_client_secret_file": ""
   },
-  "local": { "deny": [], "bash_network": false, "max_steps": 30, "read_allow": [] }
+  "local": { "deny": [], "bash_network": false, "max_steps": 30, "read_allow": [] },
+  "approvals": { "timeout_s": 120 },
+  "tasks": { "release_after_min": 30 },
+  "checks": { "timeout_s": 600 }
 }