@staix/agent-hub 0.9.0 → 0.10.0

package/CHANGELOG.md

@@ -2,6 +2,12 @@
 
 Issue and pull request numbers in the entries for 0.7.7 and earlier refer to the previous repository, archived on 2026-09-30 when this repository's history was rewritten; the one exception is the open smoke-check issue, formerly #12, which moved here as #1. Numbers in newer entries refer to this repository.
 
+## 0.10.0
+
+- Review checklists and review outcomes: review requests ask the reviewer to map signatures and call sites to the plan, read the check result and list unmet items (`hub_review {unmet}`); the hub records approved, caught, contradicted and escalated reviews per implementer, reviewer and class, shown by `ahub task show` and `ahub route explain`, and `review.adaptive` (off by default) orders reviewers by that record, after idle before busy and ahead of quota. A record counts tasks, a catch belongs to the owner whose work was caught, and only a failure on the same file or symbol contradicts an approval (#35).
+- Recovery after an unplanned stop: the hub keeps each attached peer's session identity while it runs; a hub started after a crash reports what happened to each peer in `ahub status`, resumes Kimi (ACP `session/load`), a headless Pi and the local worker (on its recorded route) when `recovery.auto_resume_after_crash` is on, and gives each peer a notice of its deliveries left in `needs_review` with its next delivery. A stop someone asked for, even one past the shutdown deadline, is not taken for a crash (#37).
+- The local worker's sandbox starts from deny default: commands may run and read the system, toolchain and project directories (and the selected Xcode or Command Line Tools dir) and write the project and temp, nothing else; `/Applications`, `/nix`, `/Volumes` and `/Users/Shared` now need `local.read_allow`; `local.sandbox: "allow-default"` (machine-local) keeps the profile of 0.9 and earlier for one release; with network on, the public CA bundles stay readable for TLS. Per-peer `capabilities` (`propose`, `assign`, `remember`, `important`) are enforced by the daemon, a malformed entry grants nothing and every refusal is logged, under deny-default the worker's commands can no longer reach the LaunchServices, CoreServices or SecurityServer brokers, and a test pins that a peer can never answer a permission request (#39).
+
 ## 0.9.0
 
 - Early conflict detection: in a git work tree, a turn that changes a file another owner's open task changed earlier warns both owners (and the console, and `events.jsonl`), once per file and task, marked concurrent when another peer worked meanwhile. `ahub check-path` and the PreToolUse hook template `templates/claude-hooks.json` give Claude the same warning before an edit, without blocking it (#32).

package/README.md

@@ -4,7 +4,7 @@ Native multi-agent hub for one developer's machine: Claude Code, Codex, Kimi Cod
 hub-owned local-LLM worker collaborate as peers in independent project directories, with
 task-aware model routing (Switchyard) in front of a self-hosted gateway (OmniRoute).
 
-Status: 0.9.0, control protocol 10. Durable delivery records distinguish queued
+Status: 0.10.0, control protocol 10. Durable delivery records distinguish queued
 work from uncertain execution. The [smoke checklist](docs/smoke.md) records
 verified paths and remaining prerequisites.
 
@@ -28,7 +28,7 @@ cd <your project> && ahub init && ahub up && ahub tail
 Or install the same version from GitHub:
 
 ```bash
-bun add -g github:STAIxBWLB/agent-hub#v0.9.0 && ahub setup
+bun add -g github:STAIxBWLB/agent-hub#v0.10.0 && ahub setup
 ```
 
 The installed commands remain `ahub` and `agent-hub`.

package/docs/operations.md

@@ -1,6 +1,6 @@
 # Operations guide
 
-This guide describes ahub 0.9.0 and control protocol 10. Live verification
+This guide describes ahub 0.10.0 and control protocol 10. Live verification
 results and remaining prerequisites are recorded separately in [the smoke ledger](smoke.md).
 
 ## Install and start
@@ -27,11 +27,38 @@ what the hub runs, which files it sends as credentials, where task text goes,
 or how far the local worker's sandbox reaches (`kimi_cmd`, `codex_bin`,
 `pi.cmd`, `checks`, `mlx.bin`, `mlx.runtimeDir`, `mlx.modelPath`, `omniroute.urls`,
 `omniroute.access_hosts`, the `omniroute` key files, `memory.worker_url`,
-`local.read_allow`, `local.bash_network`) are machine-local: they apply only
-from a file git confirms nobody committed. Put them in
+`local.read_allow`, `local.bash_network`, `local.sandbox`) are machine-local:
+they apply only from a file git confirms nobody committed. Put them in
 `.agenthub/config.local.json` (`ahub init` adds it to `.gitignore`), which is
 read after `config.json`; outside a git repository they keep their defaults, and
 an empty value always means the default.
+
+The local worker's commands run under a sandbox that starts from deny default
+(0.10): they may run and read the system, toolchain and project directories and
+the selected Xcode or Command Line Tools dir (`xcode-select -p`), write the
+project and temp, and nothing else. With `local.bash_network` on they may also
+read the public CA bundles, which the `*.pem` key deny would otherwise hide.
+`"local": { "sandbox": "allow-default" }` in `config.local.json` brings back the
+profile of 0.9 and earlier for one release, should a toolchain need a path the
+new one lacks; please report it. Newly closed outside home: `/Applications`
+(an app's bundled CLI), `/nix`, `/Volumes` and `/Users/Shared`. A toolchain
+there, or elsewhere in your home (a CI tool cache, a version manager the profile
+does not list), needs its directory in `local.read_allow`, for example
+`"/nix"` or `"~/.pixi"`.
+
+`capabilities` in `.agenthub/config.json` narrows what a peer may do with the
+hub's tools: list a peer and it keeps only the capabilities named, from
+`propose` (`hub_task_propose`), `assign` (proposing with another peer as owner),
+`remember` (the `hub_remember` tool; the notes the hub itself keeps of done
+summaries and review verdicts are not gated) and `important` (`[IMPORTANT]`
+messages). For example `"capabilities": { "local": ["propose", "remember"] }`.
+A peer that is not listed keeps all of them, a listed peer whose value is not a
+list gets none, and an unknown capability name grants nothing; `hub.log` says
+so for each, and logs every refusal (`capabilities:`). A refused tool call says
+which capability is missing; an `[IMPORTANT]` turn answer without the
+capability goes out as status, with a note to the sender.
+Approvals are never a capability: only the console (and the dashboard) answers a
+permission request.
 A committed value is ignored with a line in `hub.log`, a note from `ahub
 codex` and `ahub models`, and a row in `ahub doctor`.
 
@@ -87,6 +114,21 @@ external side effect happened unless the task's refs and a live readback show
 that effect. The hub can reassign after repeated review changes according to
 the routing configuration.
 
+A review request carries a checklist: map the changed signatures and call sites
+to the task's plan (without one, to its detail, which the request then
+includes), read the check result, and list what is
+unmet (`hub_review` takes `unmet`, `ahub review ... --unmet <item>`). The hub
+records how each review turned out, per implementer, reviewer and class:
+approved; caught (changes were requested and the owner's redo was approved);
+contradicted (within a week, work on the same file or symbol failed its check
+or review); escalated (after the reviewer asked for changes). A record counts
+tasks, not verdicts. `ahub task show <id>` lists a task's outcomes and `ahub
+route explain` shows each reviewer's record with the implementer. With
+`"review": { "adaptive": true }` in `.agenthub/config.json`, reviewers with at
+least `min_reviews` (5) reviews of that implementer in the class are ordered by
+how their reviews held up, ahead of quota but after idle before busy; off by
+default, which leaves assignment as it was.
+
 An agent can claim work nobody assigned it by proposing a task with itself as
 owner; without a class, and with no model to name one, the claim is filed as
 `implement`. A claim or an accept can carry a plan: the files, symbols and
@@ -383,8 +425,8 @@ source and carries every recovery fix released up to it. Protocol 8 and older
 project directory, without replacing the global CLI first:
 
 ```bash
-bunx --package @staix/agent-hub@0.9.0 ahub upgrade --to 0.9.0 --dry-run
-bunx --package @staix/agent-hub@0.9.0 ahub upgrade --to 0.9.0 --yes
+bunx --package @staix/agent-hub@0.10.0 ahub upgrade --to 0.10.0 --dry-run
+bunx --package @staix/agent-hub@0.10.0 ahub upgrade --to 0.10.0 --yes
 ```
 
 | Running now | Coordinator to use |
@@ -407,25 +449,26 @@ no blocker, and `--yes` stops at staging ("target protocol requires a newer
 coordinator") with an operation left to clear by `ahub recovery abort <id>`. An
 older 0.7.x CLI may lack recovery fixes released after it. The
 [smoke ledger](smoke.md) records dry-runs from real 0.6.4 and 0.7.5 hubs (issue
-#75); an applied upgrade was last proven with the 0.7.0 coordinator.
+#75), an applied upgrade with the 0.7.0 coordinator, and one from a running
+0.8.1 hub with tasks and a budget pause with the 0.9.0 coordinator.
 
 The coordinator verifies and retains the exact target package, preserves its
 own source, and promotes the global CLI only after restored projects pass
 readback.
 
-Once the installed CLI is 0.9.0, review the current project or all registered
+Once the installed CLI is 0.10.0, review the current project or all registered
 projects first:
 
 ```bash
 ahub restart --dry-run
-ahub upgrade --to 0.9.0 --dry-run
+ahub upgrade --to 0.10.0 --dry-run
 ```
 
 Apply only after reviewing the plan:
 
 ```bash
 ahub restart --yes
-ahub upgrade --to 0.9.0 --yes
+ahub upgrade --to 0.10.0 --yes
 ahub recovery status <operation-id>
 ahub recovery resume <operation-id>
 ahub recovery abort <operation-id>
@@ -448,6 +491,14 @@ block: `limits` (12 messages a minute per sender, 6 per recipient, 6
 `[IMPORTANT]` an hour, 120 s repeats) and `budget.wait_max_min` (30). Set them
 to 0 to opt out.
 
+0.10.0 changes every project's local worker: its commands run under the
+deny-default sandbox described above, and a toolchain outside the listed
+directories needs `local.read_allow`; `"local": { "sandbox": "allow-default" }`
+in `config.local.json` restores the old profile for one release. Off unless set:
+`review.adaptive`, `recovery.auto_resume_after_crash` and `capabilities`. A hub
+before 0.10.0 keeps no session record, so a crash of one is not reported as such
+by the next start.
+
 The 0.7.0 transition stages the verified package and runs a retained
 coordinator from the source tree. It accepts a verified protocol-9 source and
 moves to a protocol-10 target. The source journal, queued envelopes, tasks,
@@ -469,6 +520,29 @@ Do not run an upgrade with an incompatible active protocol, an unverified
 terminal binding, or an unresolved operation lock. Dry-run performs no package,
 plugin, daemon, or terminal mutation.
 
+### After an unplanned stop
+
+While it runs, the hub keeps each attached peer's session identity in
+`.agenthub/state/sessions.json` (ids and launch options, no message text); a stop
+removes it as it begins. When a hub starts and finds the file, the previous run
+died (`kill -9`, a crash, a lost machine), and `ahub status` and the console say
+what happened to each peer. Hubs before 0.10.0 kept no such record, so a
+crash of one is not reported this way.
+
+- Deliveries that were in flight are in `needs_review` (`ahub queue list`), as
+  before. When a peer next attaches, its next delivery starts with a notice that
+  lists them by id, sender and task (`[pii]` for a PII task), never their text.
+- Kimi, Pi and the local worker run inside the hub, so they died with it. With
+  `"recovery": { "auto_resume_after_crash": true }` in `.agenthub/config.json` the
+  hub starts them again: Kimi loads its recorded session (ACP `session/load`), Pi
+  resumes its session file, and the local worker starts without its history, on
+  its recorded route (or pinned model). Off by default: the report then says
+  what to start. A Pi that ran in a terminal (`--mode tui`) is never started by
+  the hub; the report gives the command. With `pi.auto_start` and no resume,
+  Pi starts on a fresh session as usual.
+- Codex's app-server died with the hub; run `ahub codex` again. Claude Code's
+  plugin reconnects by itself while that session is open.
+
 ## Evidence and limits
 
 The 0.6.4 release has real measurements in [the smoke checklist](smoke.md):

package/docs/quickstart.md

@@ -17,7 +17,7 @@ ahub setup                                # installs the Claude Code channel plu
 Or use the matching GitHub release:
 
 ```bash
-bun add -g github:STAIxBWLB/agent-hub#v0.9.0
+bun add -g github:STAIxBWLB/agent-hub#v0.10.0
 ahub setup
 ```
 

package/docs/security.md

@@ -11,7 +11,9 @@ agent-hub connects agents that can each run commands. This page says what the hu
 - **Telemetry holds no bodies.** `.agenthub/state/events.jsonl` (issue #40) records envelope ids, routing and sizes, task ids and states, overlapping paths and token counts. It never records a message body, a task title or detail, and marks private (PII) envelopes and tasks as such. It stays on the machine; `ahub export` only prints it.
 - **Snapshots stay in your repository.** Per-turn snapshots (issue #33) are git objects in the project's own object store, written through a temporary index; nothing is referenced, pushed or copied elsewhere, and `git gc` prunes them. They hold what the work tree held, including untracked files that are not ignored, so keep secrets in ignored files. They carry the repository's own permissions, and nothing caps their disk use but `git gc`. A turn of a peer holding an open PII task is not snapshotted; a PII file left in the project is snapshotted by later turns like any other file. `ahub undo` restores only files whose current content is exactly what the turn left.
 - **The edit hook reads, never decides.** `ahub check-path --hook` (issue #32) reads hub.db and returns context for Claude and a line for you; it sets no permission decision, so your permission rules stay in charge. It names other owners' task ids, titles and states, which then reach Claude's model; PII tasks are left out.
-- **The local worker is boxed in.** Paths are resolved through symlinks and must stay inside the project; a secrets denylist (`.env*`, keys, credential files, the hub's own state) applies to its file tools, its git arguments and its memory capture alike; `.git` and `.agenthub` are not writable. Writes, edits, shell commands and mutating git wait for approval, and the approver sees what will be written or run, with control characters escaped. Everything it executes runs under the macOS sandbox, attended or not: no writes outside the project, its git dir and temp; the home directory is unreadable except toolchains; no `.git/hooks` or `.git/config` writes; no network, loopback included. Without the sandbox there is no `bash` tool.
+- **The session record holds identities only.** `.agenthub/state/sessions.json` (issue #37, mode 600) keeps each attached peer's recovery metadata: launch options, session and thread ids, Pi's session file path. No message or task text; loss notices name deliveries by id, sender and public task title.
+- **The local worker is boxed in.** Paths are resolved through symlinks and must stay inside the project; a secrets denylist (`.env*`, keys, credential files, the hub's own state) applies to its file tools, its git arguments and its memory capture alike; `.git` and `.agenthub` are not writable. Writes, edits, shell commands and mutating git wait for approval, and the approver sees what will be written or run, with control characters escaped. Everything it executes runs under the macOS sandbox, attended or not. Since 0.10 the profile starts from deny default (issue #39): commands run and read only the system, toolchain and project directories (and the project's git dir, the selected developer dir and temp; with network on, the public CA bundles); no writes outside the project, its git dir and temp; no `.git/hooks` or `.git/config` writes; no network, loopback included, unless `local.bash_network`. `local.sandbox: "allow-default"`, machine-local, brings back the profile of 0.9 and earlier for one release. The user's temp dir is still readable in both: a command can read another tool's leftovers there. Without the sandbox there is no `bash` tool.
+- **Capabilities are enforced, not suggested.** `capabilities` (issue #39) is checked by the daemon where task operations and messages arrive, so a peer cannot get round it by phrasing. A peer can never answer a permission request: the control link takes `permit` from the console role only, and a message that quotes a permit command is just text. Both bind the hub's own tool paths: a vendor agent with its own shell in the project (Codex, Claude, Kimi) can read `.agenthub/state/control-token` and connect as the console, which only the local worker's and Pi's sandbox prevents.
 - **PII has an enforced path.** A task matching `signals.pii_patterns` goes to `local` or to nobody; its text is absent from other peers' envelopes, the console stream, the log and the board listing; the console user reviews it; `local` answers such a turn to the console only, keeps it out of its history, refuses it when the only gateway is off campus, and may not save notes or spin off tasks during it. Nothing about it is sent to claude-mem, whose observer is a cloud model.
 - **Secrets stay where they are read.** The gateway key and Cloudflare Access values are read inside the gateway client and go only into request headers: never into logs, errors, envelopes, tool output, memory, or the generated Switchyard config (the key travels by environment variable name). Subscription logins of Claude, Codex and Kimi are never proxied or pooled.
 - **The hub's own model calls are fenced.** Digest condensation and task triage read agent-written text as data; their output is capped text framed as untrusted, or a value checked against a closed list. It is never used as a route, a peer id, a tool call or an instruction.

package/docs/smoke.md

@@ -901,3 +901,39 @@ peers attached.
   - Run 1, before the hook was logged: Claude answered NONE. Whether the hook
     did not fire or the model left the reminder out was not determined; that run
     also had no stdin redirect (`< /dev/null`), which runs 2 and 3 had.
+
+## Recovery after an unplanned stop (issue #37, 2026-10-01)
+
+- AC1 baseline, released 0.7.11 in a scratch project, the fake ACP agent standing
+  in for the Kimi binary (`kimi_cmd`), `kill -9` of the daemon:
+  - the ACP child exited with the daemon;
+  - `ahub status` failed to reach the stale manifest's port;
+  - `ahub up` started a hub with no peers attached; nothing recorded Kimi's
+    session, so it could only start a new one.
+- The same run with this branch and `auto_resume_after_crash` on: `ahub up`
+  reported the crash and `kimi resumed: ... session s1 ... (ACP session/load)`,
+  and Kimi was idle on its recorded session id.
+- Pending, needs real accounts: Kimi 2.x (does it offer `loadSession`, and does
+  the resumed session keep its context), Pi with a real session file, and Codex
+  and Claude reattachment after `kill -9`.
+
+## 0.8.1 to 0.9.0 attended upgrade (2026-10-01)
+
+A scratch project (a git work tree whose `.agenthub/config.json` was written by
+the 0.8.1 `ahub init`) ran a 0.8.1 hub with two proposed tasks, one with a path
+and a detail, and an open budget pause: a peer had attached once and gone
+offline, and `ahub budget set` fed it a 95% reading. No completion check was
+configured or running, and no peer was attached at the upgrade.
+
+- `bunx --package @staix/agent-hub@0.9.0 ahub upgrade --to 0.9.0 --dry-run`
+  exited 0: one project, source 0.8.1, protocol 10, no blockers.
+- `--yes` scheduled the operation, which completed in about 10 s with the
+  project `verified`.
+- After release the hub ran 0.9.0 under a new instance id. Both tasks were on
+  the board unchanged, now with `deps: []` (the column the target adds on open),
+  the budget pause kept its reset time, and the `outcomes` table was created.
+- The coordinator promoted the global CLI to 0.9.0, and `ahub setup --yes`
+  installed the 0.9.0 plugin.
+- For about two minutes after the publish step logged `+ @staix/agent-hub@0.9.0`,
+  `npm view` still showed `latest: 0.8.1`; the registry caught up without any
+  action.

package/docs/specs/2026-09-19-agent-hub-design.md

@@ -1016,3 +1016,79 @@ session modes (`default`, `plan`, `auto`, `yolo`) but nothing per server or tool
   suppression. Limits are off in `DEFAULT_CONFIG` and on with any project config
   (12/min per sender, 6/min per recipient, 6 important an hour, 120 s repeats).
 
+## Amendment: review checklists and outcomes (issue #35)
+
+- A review request carries a checklist: map the changed signatures and call
+  sites to the task's plan, or without a plan to the task detail, which the
+  request then includes; the result of the class's check, or that none ran; and
+  `hub_review`'s `unmet`, one item each, which is appended to the verdict note.
+- Review outcomes live in a `reviews` table in hub.db: implementer, reviewer,
+  class, kind, task, time. Kinds: `approved`; `caught` (each reviewer who asked
+  for changes on the current owner's work, which was then approved);
+  `contradicted` (an approval, within seven days, of a task on the same file or
+  symbol as one whose check failed or whose review asked for changes, a
+  directory or `.` not counting; once per approval; console approvals and PII
+  tasks are not judged); `escalated` (the reviewer had asked for changes on the
+  work that was escalated, so not an escalation of unreviewed work).
+- A reviewer's record with an implementer in a class counts tasks: n = the tasks
+  it reviewed (approved, caught or escalated), held = (n - contradicted tasks) /
+  n. `assign()` takes the records as input and always shows them in its trace;
+  with `review.adaptive` it orders reviewer candidates that have at least
+  `min_reviews` by held, others keep their place, and the implementer is never
+  a candidate. The record is applied after quota, so the order is idle before
+  busy, then the record, then quota.
+
+## Amendment: recovery after an unplanned stop (issue #37)
+
+- The continuous record is `sessions.json` (instance id, time, and each attached
+  peer's `recoveryMetadata()`), rewritten when a peer's state changes and
+  removed when a stop of the run that wrote it begins (a stop that then runs past
+  the shutdown deadline is still not a crash). Found at start, with no
+  controlled-restart state in play, it means the previous run crashed; the new
+  run takes the record over at once, so its own clean stop removes it even when
+  no peer attaches. A controlled restart's target removes any record it finds.
+- Limits: a second crash before the peers attach loses their loss notices (the
+  journal rows stay in `needs_review`, shown by `ahub queue list`), and the first
+  attach rewrites the record with only the attached peers. A Pi in TUI mode is
+  reported with its command, not resumed: the CLI runs its terminal.
+- Resume goes through the same start path as `ahub kimi` / `ahub pi` / `ahub
+  local`: Kimi with `sessionId` (ACP `session/load`, refused when the agent does
+  not offer `loadSession`), Pi with its session file, the local worker afresh.
+  Codex and Claude are reported, not resumed: the TUI and the Claude session live
+  outside the hub. The issue's Codex `thread/resume` needs the TUI, so the report
+  names the thread instead.
+- Loss notices use the bus preface, not an envelope: a peer's `needs_review`
+  rows block its later deliveries, so a notice queued behind them would arrive
+  only after they are resolved anyway; the preface leads that next delivery. Only
+  rows still in `needs_review` when the peer attaches are listed.
+- `recovery.auto_resume_after_crash` is off by default, also with a project
+  config: an automatic start spends quota the user did not ask for.
+
+## Amendment: deny-default sandbox and capabilities (issue #39)
+
+- The deny-default profile allows exec and reads of the system directories
+  (`/usr`, `/bin`, `/sbin`, `/System`, `/Library`, `/opt`, `/private/etc`, the
+  dyld and timezone databases), the toolchain directories in home, `read_allow`,
+  the project, its external git dirs, the selected developer dir (`xcode-select
+  -p`) and temp; writes as before; a short list of mach services (directory
+  lookups, logging, notifications), plus name resolution and TLS trust when
+  network is on, the trust being the public CA bundles allowed by exact path
+  after the denies (the `*.pem` key deny matches them); no brokers that act
+  outside the sandbox (LaunchServices, SecurityServer). The denies at the end (credential
+  stores, the denylist, `.agenthub`, git hooks and config) are shared by both
+  bases.
+- The issue's allowlist proxy for `local.bash_network` is not built here: with
+  the flag on, network is allowed as in 0.9 and earlier. It is left for a
+  follow-up issue.
+- `local.sandbox` ("deny-default" | "allow-default") is machine-local, since
+  "allow-default" widens the sandbox.
+- Capabilities: `propose`, `assign` (a proposal naming another peer as owner),
+  `remember`, `important`. A peer not listed in `capabilities` has all of them,
+  which keeps today's behaviour, and a listed peer whose value is not a list has
+  none; the console user and the hub are never limited. `remember` gates the
+  `hub_remember` tool only, not the notes the hub keeps of done summaries and
+  review verdicts. Every refusal, a malformed entry and an unknown capability
+  name are logged.
+  `important` is checked where messages are admitted, the others in the task
+  operations, so in-process tools (the local worker, Pi) are covered too.
+

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@staix/agent-hub",
-  "version": "0.9.0",
+  "version": "0.10.0",
   "description": "Native multi-agent hub: Claude Code, Codex, Kimi Code, Pi and local inference as peers in one project",
   "license": "MIT",
   "type": "module",

package/plugins/agent-hub/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "agent-hub",
-  "version": "0.9.0",
+  "version": "0.10.0",
   "description": "Channel between Claude Code and the agent-hub daemon: peer messages from Codex, Kimi and the local worker arrive as channel events; hub_send replies.",
   "author": {
     "name": "Young Joon Lee",

package/plugins/agent-hub/server.js

@@ -15727,7 +15727,7 @@ class ControlClient {
 // package.json
 var package_default = {
   name: "@staix/agent-hub",
-  version: "0.9.0",
+  version: "0.10.0",
   description: "Native multi-agent hub: Claude Code, Codex, Kimi Code, Pi and local inference as peers in one project",
   license: "MIT",
   type: "module",
@@ -15820,7 +15820,7 @@ var TASK_TOOLS = [
   tool("hub_task_decline", "Pass on a task assigned to you; the hub offers it to the next peer.", { id, reason: str }, ["id"]),
   tool("hub_task_done", "Mark your task finished. It goes to its reviewer with your summary and refs. When the project configures a check for its class, the hub runs it first and the result comes as a task message: a failed check keeps the task with you.", { id, summary: { type: "string", description: "what changed, why, and the check you ran with its result" }, refs }, ["id", "summary"]),
   tool("hub_task_list", "The task board. PII tasks show as [pii].", { state: { type: "string", enum: ["proposed", "in_progress", "in_review", "approved", "changes_requested"] }, ready: { type: "boolean", description: "only proposed tasks with nothing left to wait for" } }),
-  tool("hub_review", "Give your verdict on a task you were asked to review. Two changes_requested in a row move the task to another peer.", { id, verdict: { type: "string", enum: ["approved", "changes_requested"] }, note: str }, ["id", "verdict"]),
+  tool("hub_review", "Give your verdict on a task you were asked to review: map the changed signatures and call sites to the task's plan or detail, read the check result, and list what is unmet. Two changes_requested in a row move the task to another peer.", { id, verdict: { type: "string", enum: ["approved", "changes_requested"] }, note: str, unmet: { type: "array", items: str, description: "each requirement of the plan or detail that the change does not meet" } }, ["id", "verdict"]),
   tool("hub_checkpoint", "Answer a checkpoint request from the hub (your quota window is nearly used up): what you were doing, what is half done, what whoever continues must know. Write the same to .agenthub/checkpoint.md first if you can.", { summary: str }, ["summary"]),
   tool("hub_remember", "Save a decision, finding, contract or fail to the memory all agents share (claude-mem); the other agents also get it with their next message. A fail is an approach you tried that does not work, and why: the most useful note, it stops the others spending their quota on it. Do not retry what a fail note rules out without new evidence. Conclusions worth recalling, not chatter.", { text: str, title: str, kind: { type: "string", enum: [...NOTE_KINDS] }, task: id }, ["text"])
 ];

package/src/adapters/acp.ts

@@ -22,6 +22,8 @@ export interface AcpOptions {
   cmd: string[];
   /** Coordinator-visible selected model only; contains no prompts or command arguments. */
   launchModel?: string;
+  /** Load this earlier session (ACP `session/load`) instead of starting a new one: crash recovery, issue #37. */
+  resumeSessionId?: string;
   cwd: string;
   /** Optional launch environment; recovery authority is always removed before spawn. */
   env?: NodeJS.ProcessEnv;
@@ -92,11 +94,17 @@ export class AcpPeer extends BasePeer {
     createInterface({ input: proc.stdout }).on("line", (line) => this.onLine(line));
 
     const handshake = async () => {
-      await this.request("initialize", {
+      const init = await this.request("initialize", {
         protocolVersion: 1,
         clientCapabilities: { fs: { readTextFile: false, writeTextFile: false }, terminal: false },
       });
-      return this.request("session/new", { cwd: this.opts.cwd, mcpServers: this.opts.mcpServers ?? [] });
+      const resume = this.opts.resumeSessionId;
+      if (!resume) return this.request("session/new", { cwd: this.opts.cwd, mcpServers: this.opts.mcpServers ?? [] });
+      // The agent replays the session as updates while it loads; they arrive before the peer is idle, so none of
+      // them is taken for an answer.
+      if (!init?.agentCapabilities?.loadSession) throw new Error(`${this.id} cannot load an earlier session (the agent offers no loadSession)`);
+      await this.request("session/load", { sessionId: resume, cwd: this.opts.cwd, mcpServers: this.opts.mcpServers ?? [] });
+      return { sessionId: resume };
     };
     const timeout = new Promise<never>((_, reject) => {
       setTimeout(() => reject(new Error(`${this.id} did not complete the ACP handshake within ${HANDSHAKE_MS / 1000} s`)), HANDSHAKE_MS).unref();

package/src/adapters/local-worker.ts

@@ -17,7 +17,7 @@ export interface LocalOptions {
   route?: string;
   /** Model id sent straight to OmniRoute when the sidecar is absent, unhealthy or fails a call. */
   fixedModel: string;
-  tools: { deny: string[]; permit: ToolContext["permit"]; bashNetwork?: boolean; readAllow?: string[] };
+  tools: { deny: string[]; permit: ToolContext["permit"]; bashNetwork?: boolean; readAllow?: string[]; sandbox?: "deny-default" | "allow-default" };
   capture?: Capture;
   /** Runs a hub task tool (hub_task_*, hub_review, hub_remember) as this peer. Absent = the tools are not offered. */
   taskTool?: (name: string, args: Record<string, unknown>, turn: { pii: boolean }) => Promise<string>;
@@ -67,7 +67,7 @@ export class LocalPeer extends BasePeer {
     private readonly opts: LocalOptions,
   ) {
     super(id, opts.watchdogMs);
-    this.sandboxProfile = profile(opts.cwd, opts.tools.bashNetwork ?? false, opts.tools.readAllow, opts.tools.deny);
+    this.sandboxProfile = profile(opts.cwd, opts.tools.bashNetwork ?? false, opts.tools.readAllow, opts.tools.deny, opts.tools.sandbox === "allow-default" ? "allow" : "deny");
   }
 
   recoveryMetadata(): Record<string, unknown> {

package/src/cli/main.ts

@@ -73,7 +73,7 @@ const USAGE = `agent-hub ${VERSION}: Claude Code, Codex and Kimi as peers in one
   ahub task propose [--class <c> | <class>] <title...> [--owner <peer>] [--path <p>]... [--after <id>]... [--urgent] [--detail <text>]
   ahub task show|escalate <id>  full task with history (PII text included) / hand it to the next peer in escalate_to
   ahub task assign <id> <peer>  give a task to a peer yourself
-  ahub review <id> approved|changes_requested [note...]
+  ahub review <id> approved|changes_requested [note...] [--unmet <item>]...
   ahub remember <text...>       save a note to the memory all agents share
   ahub ask [--remember] <question...>   answer from the task board, shared memory and this run's log, with the ids it rests on
   ahub route explain <id>       why a task went where it went
@@ -693,9 +693,10 @@ const commands: Record<string, () => Promise<void> | void> = {
   },
 
   review: async () => {
-    const [id, verdict, ...note] = args;
-    if (!id || !verdict) fail("usage: ahub review <id> approved|changes_requested [note...]");
-    console.log(await taskOp("hub_review", { id: Number(id), verdict, note: note.join(" ") }));
+    const { many, rest } = takeFlags(args, [], ["--unmet"]);
+    const [id, verdict, ...note] = rest;
+    if (!id || !verdict) fail("usage: ahub review <id> approved|changes_requested [note...] [--unmet <item>]...");
+    console.log(await taskOp("hub_review", { id: Number(id), verdict, note: note.join(" "), ...(many["--unmet"]?.length ? { unmet: many["--unmet"] } : {}) }));
   },
 
   remember: async () => console.log(await taskOp("hub_remember", { text: freeText(args, "ahub remember <text>") })),
@@ -744,6 +745,7 @@ const commands: Record<string, () => Promise<void> | void> = {
     if (args.includes("--json")) return console.log(JSON.stringify(status, null, 2));
     console.log(`hub pid ${status.pid}, control 127.0.0.1:${status.controlPort}, ${status.cwd}`);
     if (status.deliveryError) console.log(`  delivery storage: ${status.deliveryError}; dispatch is stopped`);
+    for (const line of (status as { crash?: string[] }).crash ?? []) console.log(`  crash recovery: ${line}`);
     const peers = Object.entries(status.peers as Record<string, PeerRow>);
     for (const [id, p] of peers) console.log(peerLine(id, p));
     const models = (status as any).models?.backends as BackendRow[] | undefined;

package/src/hub/board.ts

@@ -74,6 +74,11 @@ export class Board {
     // Who did well or badly at which class, for demotion (issue #36). Only peers, classes and times: no task text.
     this.db.run("CREATE TABLE IF NOT EXISTS outcomes (peer TEXT NOT NULL, class TEXT NOT NULL, ok INTEGER NOT NULL, at INTEGER NOT NULL)");
     this.db.run("CREATE INDEX IF NOT EXISTS outcomes_class_at ON outcomes (class, at)");
+    // How reviews turned out, per (implementer, reviewer, class) (issue #35): approved, contradicted later, caught, escalated.
+    this.db.run("CREATE TABLE IF NOT EXISTS reviews (implementer TEXT NOT NULL, reviewer TEXT NOT NULL, class TEXT NOT NULL, kind TEXT NOT NULL, task INTEGER NOT NULL, at INTEGER NOT NULL)");
+    // ponytail: kept for good (a record is the whole history); prune by age if it ever grows large.
+    this.db.run("CREATE INDEX IF NOT EXISTS reviews_class ON reviews (class)");
+    this.db.run("CREATE INDEX IF NOT EXISTS reviews_task ON reviews (task)");
     // Boards from before issues #31 and #34 lack these columns; existing rows get the defaults.
     const have = new Set((this.db.query("PRAGMA table_info(tasks)").all() as { name: string }[]).map((c) => c.name));
     for (const [col, empty] of [["plan", "{}"], ["deps", "[]"]] as const) {
@@ -135,11 +140,32 @@ export class Board {
     return this.db.query("SELECT peer, ok, at FROM outcomes WHERE class = ? AND at >= ?").all(cls, since) as { peer: PeerId; ok: number; at: number }[];
   }
 
+  recordReview(r: Omit<ReviewOutcome, "at">, at = Date.now()): void {
+    this.db.query("INSERT INTO reviews (implementer, reviewer, class, kind, task, at) VALUES (?, ?, ?, ?, ?, ?)").run(r.implementer, r.reviewer, r.class, r.kind, r.task, at);
+  }
+
+  /** One task's review outcomes, or a class's (for reviewer choice). */
+  reviews(where: { task: number } | { class: TaskClass }): ReviewOutcome[] {
+    return ("task" in where
+      ? this.db.query("SELECT * FROM reviews WHERE task = ? ORDER BY at").all(where.task)
+      : this.db.query("SELECT * FROM reviews WHERE class = ? ORDER BY at").all(where.class)) as ReviewOutcome[];
+  }
+
   close(): void {
     this.db.close();
   }
 }
 
+export interface ReviewOutcome {
+  implementer: PeerId;
+  reviewer: PeerId;
+  class: TaskClass;
+  /** approved; contradicted (a later check failure or changes requested on the same places); caught (changes requested, then the redo passed); escalated */
+  kind: "approved" | "contradicted" | "caught" | "escalated";
+  task: number;
+  at: number;
+}
+
 function parse(row: Record<string, unknown>): Task {
   const out = { ...row } as Record<string, unknown>;
   for (const col of JSON_COLS) out[col] = JSON.parse(String(row[col]));

package/src/hub/config-trust.ts

@@ -24,6 +24,7 @@ export const MACHINE_LOCAL = [
   "memory.worker_url",
   "local.read_allow",
   "local.bash_network",
+  "local.sandbox", // "allow-default" widens what the worker's commands may do
 ] as const;
 
 /**

package/src/hub/crash.ts

@@ -0,0 +1,104 @@
+import { chmodSync, existsSync, readFileSync, renameSync, rmSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
+import type { JournalDelivery } from "./delivery-journal.ts";
+
+/**
+ * Unplanned-crash recovery (issue #37). While the hub runs it keeps `sessions.json`: each attached peer's session
+ * identity (the adapters' recovery metadata: ids and launch options, never message text). A clean stop removes the
+ * file, so finding it at start means the previous run died.
+ */
+export interface SessionRecord {
+  peer: string;
+  /** The adapter's recovery metadata: `launch`, and `sessionId` / `threadId` / `sessionFile` where it has one. */
+  meta: Record<string, unknown>;
+}
+export interface SessionsFile {
+  instanceId: string;
+  at: number;
+  peers: SessionRecord[];
+}
+
+const fileOf = (stateDir: string) => join(stateDir, "sessions.json");
+
+export function writeSessions(stateDir: string, s: SessionsFile): void {
+  const tmp = `${fileOf(stateDir)}.tmp`;
+  writeFileSync(tmp, `${JSON.stringify(s)}\n`, { mode: 0o600 });
+  chmodSync(tmp, 0o600);
+  renameSync(tmp, fileOf(stateDir));
+}
+
+export function readSessions(stateDir: string): SessionsFile | undefined {
+  if (!existsSync(fileOf(stateDir))) return undefined;
+  try {
+    const s = JSON.parse(readFileSync(fileOf(stateDir), "utf8")) as SessionsFile;
+    return Array.isArray(s.peers) ? s : undefined;
+  } catch {
+    return undefined; // cut short by the crash: nothing to resume from
+  }
+}
+
+/**
+ * Only the run that wrote it removes it: a stop of an older instance must not erase a newer run's record. Without an
+ * instance id it goes whatever wrote it (a controlled restart, which has its own record of the peers).
+ */
+export function removeSessions(stateDir: string, instanceId?: string): void {
+  if (instanceId === undefined || readSessions(stateDir)?.instanceId === instanceId) rmSync(fileOf(stateDir), { force: true });
+}
+
+const str = (v: unknown) => (typeof v === "string" && v ? v : undefined);
+
+/**
+ * What can come back after a crash. `resume` holds the start arguments for peers the hub launches itself (Kimi through
+ * ACP `session/load`, Pi through its session file, the local worker afresh); the others say what the user has to do.
+ */
+export function crashPlan(records: SessionRecord[]): { peer: string; resume?: Record<string, string>; how: string }[] {
+  return records.map(({ peer, meta }) => {
+    const launch = (meta.launch && typeof meta.launch === "object" ? meta.launch : {}) as Record<string, unknown>;
+    const model = str(launch.model);
+    switch (peer) {
+      case "claude":
+        return { peer, how: "claude: the Claude Code plugin reconnects by itself while that session is still open" };
+      case "codex":
+        return { peer, how: `codex: its app-server died with the hub; run ahub codex again${str(meta.threadId) ? ` (its conversation was thread ${meta.threadId})` : ""}` };
+      case "kimi": {
+        const sessionId = str(meta.sessionId);
+        if (!sessionId) return { peer, how: "kimi: no session id was recorded; start it again with ahub kimi" };
+        return { peer, resume: { sessionId, ...(model ? { model } : {}) }, how: `kimi: session ${sessionId} can be loaded again (ACP session/load)` };
+      }
+      case "pi": {
+        const sessionFile = str(meta.sessionFile) ?? str(launch.sessionFile);
+        if (!sessionFile) return { peer, how: "pi: no session file was recorded; start it again with ahub pi" };
+        // A terminal Pi is run by the CLI that launched it, not by the hub: nothing here could start it again.
+        if (str(launch.mode) === "tui") return { peer, how: `pi: it ran in a terminal; start it again with ahub pi --mode tui --session-file ${sessionFile}` };
+        const args: Record<string, string> = { sessionFile };
+        for (const k of ["mode", "backend", "model"] as const) if (str(launch[k])) args[k] = str(launch[k])!;
+        return { peer, resume: args, how: `pi: its session file can be resumed (${sessionFile})` };
+      }
+      case "local": {
+        // `model` is also recorded as the route's fallback, and a model given at start pins it: pass one or the other.
+        const route = str(launch.route);
+        const args: Record<string, string> = route ? { route } : model ? { model } : {};
+        return { peer, resume: args, how: "local: starts again without its history (the worker keeps none across a hub stop)" };
+      }
+      default:
+        return { peer, how: `${peer}: reconnects by itself if its client is still running` };
+    }
+  });
+}
+
+/**
+ * The loss notice for one peer: the deliveries to it that the crash left in needs_review, with their senders and the
+ * tasks they were about. `taskTitle` must return the public title (`#n [pii]` for a PII task). No message text.
+ */
+export function lossNotice(lost: JournalDelivery[], taskTitle: (id: number) => string | undefined): string {
+  const lines = lost.map((d) => {
+    const from = [...new Set(d.originals.map((e) => e.from))].join(", ");
+    const tasks = [...new Set(d.originals.map((e) => Number(e.refs?.task)).filter((n) => Number.isInteger(n) && n > 0))].map((n) => taskTitle(n) ?? `#${n}`);
+    return `- delivery ${d.id} from ${from}${tasks.length ? `, about task ${tasks.join(", ")}` : ""}`;
+  });
+  return [
+    "The hub stopped unexpectedly and was started again. These deliveries to you were in flight when it stopped, so whether you acted on them is not known; the console has since marked each one completed, retried or discarded:",
+    ...lines,
+    "Check your work against them before you go on.",
+  ].join("\n");
+}

package/src/hub/daemon.ts

@@ -42,6 +42,8 @@ import { MemoryClient, workerUrl } from "../memory/client.ts";
 import { VERSION } from "../version.ts";
 import { projectChain, recallFor } from "../memory/recall.ts";
 import { conflictsOf } from "./conflicts.ts";
+import { crashPlan, lossNotice, readSessions, removeSessions, writeSessions, type SessionsFile } from "./crash.ts";
+import type { JournalDelivery } from "./delivery-journal.ts";
 import { DEFAULT_LIMITS, Limiter, PROJECT_LIMITS, type LimitsConfig } from "./limits.ts";
 import { changedPaths, repoOf, snapshot, Turns } from "./snapshots.ts";
 import { archiveRestartSnapshot, readRestartSnapshot, removeRestartSnapshot, restartPath, writeRestartSnapshot, type RecoveryPhase, type RestartPeerSnapshot, type RestartSnapshot } from "./restart.ts";
@@ -60,7 +62,8 @@ export interface HubConfig {
   omniroute: OmniRouteConfig;
   pi: { enabled: boolean; auto_start: boolean; cmd: string[]; backend: "auto" | "dgx" | "mlx"; dgx_coding: string; dgx_fast: string; max_steps: number };
   mlx: Pick<MlxOptions, "provider" | "host" | "runtimeDir" | "modelPath" | "port" | "model" | "sourceModel" | "contextWindow" | "maxInputTokens" | "maxTokens" | "maxConcurrency">;
-  local: { deny: string[]; bash_network: boolean; max_steps: number; read_allow: string[] };
+  /** `sandbox`: "deny-default" (issue #39), or "allow-default", the profile of 0.9 and earlier, kept for one release. */
+  local: { deny: string[]; bash_network: boolean; max_steps: number; read_allow: string[]; sandbox: "deny-default" | "allow-default" };
   /** Pending permission requests: how long they wait, and whether the desktop is told (issue #5). */
   approvals: { timeout_s: number; notify: boolean };
   /** An owner offline this long loses its open tasks back to routing; 0 turns it off (issue #6). */
@@ -71,6 +74,12 @@ export interface HubConfig {
   snapshots: { enabled: boolean; keep: number };
   /** Per-sender rate limits and repeat suppression for what agents send (issue #38). */
   limits: LimitsConfig;
+  /** Reviewer choice from recorded review outcomes, once a reviewer has `min_reviews` of an implementer (issue #35). */
+  review: { adaptive: boolean; min_reviews: number };
+  /** After an unplanned stop, start Kimi, Pi and the local worker again with their recorded sessions (issue #37). */
+  recovery: { auto_resume_after_crash: boolean };
+  /** Per peer, the hub-tool capabilities it has (issue #39); a peer not listed has all of them. */
+  capabilities: Record<string, string[]>;
   /** Machine-local fields a config file set but git could not vouch for, and why (issue #17). */
   ignored?: string[];
 }
@@ -88,7 +97,7 @@ export const DEFAULT_CONFIG: HubConfig = {
   omniroute: DEFAULT_OMNIROUTE,
   pi: { enabled: false, auto_start: false, cmd: ["pi"], backend: "auto", dgx_coding: "coding", dgx_fast: "fast", max_steps: 30 },
   mlx: { provider: "ollama", model: "agenthub-fast-mlx:4b-8k", sourceModel: "qwen3.5:4b-mlx", contextWindow: 8192, maxInputTokens: 6000, maxTokens: 2048, maxConcurrency: 1 },
-  local: { deny: [], bash_network: false, max_steps: 30, read_allow: [] },
+  local: { deny: [], bash_network: false, max_steps: 30, read_allow: [], sandbox: "deny-default" },
   // Off here, so tests and a hub without a config file stay silent; a project's config defaults it on for macOS.
   approvals: { timeout_s: 120, notify: false },
   tasks: { release_after_min: 30 },
@@ -96,6 +105,9 @@ export const DEFAULT_CONFIG: HubConfig = {
   // Off here like approvals.notify, so tests (whose cwd is this repository) write no objects; a project's config turns it on.
   snapshots: { enabled: false, keep: 20 },
   limits: DEFAULT_LIMITS,
+  review: { adaptive: false, min_reviews: 5 },
+  recovery: { auto_resume_after_crash: false },
+  capabilities: {},
 };
 
 export { stateDirFor };
@@ -106,7 +118,7 @@ const PEER_ID = /^[a-z][a-z0-9-]{0,31}$/;
 
 /** The shared project config, then the machine's own file, which overrides it block by block (issue #17). */
 const CONFIG_FILES = ["config.json", "config.local.json"] as const;
-const CONFIG_BLOCKS = ["memory", "roles", "budget", "inference", "omniroute", "local", "pi", "approvals", "tasks", "checks", "snapshots", "limits", "mlx"];
+const CONFIG_BLOCKS = ["memory", "roles", "budget", "inference", "omniroute", "local", "pi", "approvals", "tasks", "checks", "snapshots", "limits", "review", "recovery", "capabilities", "mlx"];
 
 export function loadConfig(cwd: string): HubConfig {
   const ignored: string[] = [];
@@ -151,6 +163,9 @@ export function loadConfig(cwd: string): HubConfig {
     checks: { ...DEFAULT_CONFIG.checks, ...file.checks },
     snapshots: { ...DEFAULT_CONFIG.snapshots, enabled: true, ...file.snapshots },
     limits: { ...PROJECT_LIMITS, ...file.limits }, // on with any project config (issue #38)
+    review: { ...DEFAULT_CONFIG.review, ...file.review },
+    recovery: { ...DEFAULT_CONFIG.recovery, ...file.recovery },
+    capabilities: { ...file.capabilities },
     mlx,
     ...(ignored.length ? { ignored } : {}),
   };
@@ -280,9 +295,35 @@ export async function startDaemon(opts: DaemonOptions) {
     : undefined;
   if ((restartFilePresent && !restored) || (recoveryOperation && !restored)) throw new Error("restart state is unreadable, missing, or does not match this project and recovery operation");
 
+  // A session record left by a run that never shut down means it crashed (issue #37). A controlled restart has its own.
+  const crashed = !recoveryOperation && !restartFilePresent ? readSessions(opts.stateDir) : undefined;
+  // A controlled restart's source may have been cut short before it removed its record: this run is not a crash, and
+  // a record left now would make the next ordinary start look like one.
+  if (recoveryOperation || restartFilePresent) try { removeSessions(opts.stateDir); } catch { /* nothing to remove */ }
+  const autoResume = config.recovery.auto_resume_after_crash === true; // a string "false" is not a yes
+  const startedAt = Date.now();
+  /** What crash recovery did or asks the user to do, for `ahub status`. */
+  const crashReport: string[] = [];
+
   // The hub's own model calls (digest condensation, task triage) are wired below, once the gateway client exists.
   let inference: Inference | undefined;
   const journal = new DeliveryJournal({ file: join(opts.stateDir, "hub.db"), projectRoot: opts.cwd, projectId, instanceId, operationId: recoveryOperation });
+  // What the crash left in flight, per recipient: opening the journal just marked these needs_review.
+  const lost = new Map<PeerId, JournalDelivery[]>();
+  if (crashed) for (const d of journal.list()) if (d.state === "needs_review" && d.reason === "daemon stopped during delivery" && d.updatedAt >= startedAt) lost.set(d.peer, [...(lost.get(d.peer) ?? []), d]);
+  // Capabilities (issue #39): enforced here and in taskOp, never by role text alone. Unlisted peers keep everything.
+  // A listed peer whose value is not a list gets nothing: whoever listed it meant to narrow it.
+  const may = (peer: PeerId, cap: "propose" | "assign" | "remember" | "important"): boolean => {
+    if (peer === USER || peer === HUB || !Object.hasOwn(config.capabilities, peer)) return true;
+    const list = config.capabilities[peer];
+    return Array.isArray(list) && list.includes(cap);
+  };
+  const CAPABILITIES = ["propose", "assign", "remember", "important"];
+  for (const [peer, list] of Object.entries(config.capabilities)) {
+    if (!PEER_ID.test(peer)) log(`capabilities.${peer} is not a peer id; ignored (capabilities is an object of lists, one per peer)`);
+    else if (!Array.isArray(list)) log(`capabilities.${peer} is not a list: ${peer} gets no capabilities`);
+    else for (const c of list) if (!CAPABILITIES.includes(c)) log(`capabilities.${peer}: ${JSON.stringify(c)} is not a capability (${CAPABILITIES.join(", ")}); it grants nothing`);
+  }
   // Agents only: the console user and the hub itself are never limited (issue #38).
   // A typo such as "12/min" would read as 0, which turns a limit off without a word: the project default instead.
   for (const k of Object.keys(config.limits)) if (!(k in PROJECT_LIMITS)) log(`limits.${k} is not a known limit; ignored`);
@@ -296,6 +337,10 @@ export async function startDaemon(opts: DaemonOptions) {
   const admit = (env: Envelope, parent?: string): string | undefined => {
     // [FYI] is recorded and costs nobody a turn: nothing to limit.
     if (env.from === USER || env.from === HUB || env.from === DIGEST || env.priority === "fyi") return undefined;
+    if (env.priority === "important" && !may(env.from, "important")) {
+      log(`capabilities: ${env.from} may not send important messages`);
+      return `${env.from} may not send important messages (no "important" in capabilities.${env.from}): send it without [IMPORTANT]`;
+    }
     const refused = limiter.admit(env.from, env.to, env.priority, env.body, parent);
     if (refused) log(`limits: ${env.from}: ${refused}`);
     return refused;
@@ -410,6 +455,7 @@ export async function startDaemon(opts: DaemonOptions) {
     },
     triage: { classify: (title, detail) => inference?.triage(title, detail) ?? Promise.resolve(undefined), onCampus: () => onCampus() },
     quota: (): ReturnType<Budget["headroom"]> => budget.headroom(), // budget is built below; this runs at assignment time
+    review: config.review,
   });
   board.onChange = (t, h) => event({ type: "task", id: t.id, event: h.event, by: h.by, state: t.state, owner: t.owner, reviewer: t.reviewer, class: t.class, pii: tasks.isPii(t) });
   // ---- budget relay -------------------------------------------------------------------------------------------
@@ -570,6 +616,16 @@ export async function startDaemon(opts: DaemonOptions) {
     // console reads a PII task's text deliberately, with `ahub task show <id>`.
     const onPrem = inProcess && by === "local";
     const line = (t: { id: number; state: string; owner: PeerId | null; reviewer: PeerId | null }) => `task #${t.id}: ${t.state}, owner ${t.owner ?? "none"}, reviewer ${t.reviewer ?? "none"}`;
+    const need = (cap: "propose" | "assign" | "remember", what: string) => {
+      if (may(by, cap)) return;
+      log(`capabilities: ${by} may not ${what} (${op})`);
+      throw new Error(`${by} may not ${what} (no "${cap}" in capabilities.${by} in .agenthub/config.json)`);
+    };
+    if (op === "hub_task_propose") {
+      need("propose", "propose tasks");
+      if (typeof a.owner === "string" && a.owner && a.owner !== by) need("assign", "hand tasks to other peers");
+    }
+    if (op === "hub_remember") need("remember", "save notes to shared memory");
     switch (op) {
       case "hub_task_propose": {
         const t = await tasks.propose(by, a);
@@ -588,7 +644,7 @@ export async function startDaemon(opts: DaemonOptions) {
         return tasks.isChecking(t.id) ? `${line(t)}; its check is queued or running, and the result comes as a task message` : line(t);
       }
       case "hub_review":
-        return line(await tasks.review(by, a.id, a.verdict, a.note));
+        return line(await tasks.review(by, a.id, a.verdict, a.note, a.unmet));
       case "hub_remember":
         return tasks.remember(by, a);
       case "hub_checkpoint": {
@@ -604,7 +660,7 @@ export async function startDaemon(opts: DaemonOptions) {
     if (by !== USER) throw new Error(`${op} is a console command`);
     switch (op) {
       case "task_show":
-        return JSON.stringify(board.get(Number(a.id)) ?? `no task #${a.id}`, null, 2);
+        return JSON.stringify(board.get(Number(a.id)) ? { ...board.get(Number(a.id)), reviews: board.reviews({ task: Number(a.id) }) } : `no task #${a.id}`, null, 2);
       case "task_assign":
         return line(await tasks.assignTo(a.id, String(a.peer)));
       case "task_escalate":
@@ -735,6 +791,7 @@ export async function startDaemon(opts: DaemonOptions) {
     return now;
   };
   const status = () => ({
+    ...(crashReport.length ? { crash: crashReport } : {}),
     projectId,
     instanceId,
     version: VERSION,
@@ -833,6 +890,36 @@ export async function startDaemon(opts: DaemonOptions) {
     }
   };
 
+  // Session identities of the attached peers, kept current for crash recovery (issue #37); a clean stop removes them.
+  let sessionsWritten = "";
+  const recordSessions = () => {
+    if (stopping) return;
+    const peers = [...bus.peers.values()].filter((p) => p.state !== "offline").map((p) => {
+      let meta: Record<string, unknown> = {};
+      try { meta = (p as { recoveryMetadata?: () => Record<string, unknown> }).recoveryMetadata?.() ?? {}; } catch { /* not ready yet: the id alone */ }
+      return { peer: p.id, meta };
+    });
+    const text = JSON.stringify(peers);
+    if (text === sessionsWritten) return;
+    sessionsWritten = text;
+    try { writeSessions(opts.stateDir, { instanceId, at: Date.now(), peers }); } catch (error) { log(`session record not written: ${(error as Error).message}`); }
+  };
+  const recoverAfterCrash = async (prev: SessionsFile) => {
+    const report = (line: string) => (crashReport.push(line), notify(`crash recovery: ${line}`));
+    const lostCount = [...lost.values()].reduce((n, l) => n + l.length, 0);
+    report(`the previous hub run stopped without shutting down${lostCount ? `; ${lostCount} deliveries it had in flight are in needs_review (ahub queue list)` : ""}`);
+    for (const step of crashPlan(prev.peers)) {
+      if (!step.resume || !autoResume) {
+        const fresh = step.peer === "pi" && config.pi.enabled && config.pi.auto_start ? "; pi.auto_start starts a fresh session" : "";
+        report(`${step.how}${step.resume ? " (recovery.auto_resume_after_crash is off)" : ""}${fresh}`);
+        continue;
+      }
+      const r = await startPeer(step.peer, step.resume as Parameters<typeof startPeer>[1]).catch((e: Error) => ({ ok: false, error: e.message }));
+      report(r.ok ? `${step.peer} resumed: ${step.how}` : `${step.peer} not resumed (${String(r.error)}); ${step.how}`);
+    }
+    writeStatus();
+  };
+
   bus.tap((e) => {
     e = redact(e);
     uiEvents.push({ seq: ++uiSequence, event: e });
@@ -873,6 +960,13 @@ export async function startDaemon(opts: DaemonOptions) {
       }
       if (e.state === "offline") offlineSince.set(e.peer, offlineSince.get(e.peer) ?? Date.now());
       else offlineSince.delete(e.peer);
+      // After a crash, a peer's first attach brings the loss notice: it leads its next delivery (issue #37).
+      if (e.state !== "offline" && lost.has(e.peer)) {
+        const still = lost.get(e.peer)!.filter((d) => { try { return journal.get(d.id)?.state === "needs_review"; } catch { return false; } });
+        lost.delete(e.peer);
+        if (still.length) bus.preface(e.peer, lossNotice(still, (id) => { const t = board.get(id); return t ? tasks.publicTitle(t) : undefined; }));
+      }
+      recordSessions();
     }
     else if (e.t === "undeliverable" || e.t === "overflow") {
       log(e.t === "undeliverable" ? `UNDELIVERABLE to ${e.peer} after retries: ${e.env.id} from ${e.env.from}` : `OVERFLOW ${e.peer}: dropped ${e.env.id} from ${e.env.from}`);
@@ -1023,6 +1117,7 @@ export async function startDaemon(opts: DaemonOptions) {
       const kimi = new AcpPeer("kimi", {
         cmd,
         ...(args.model ? { launchModel: args.model } : {}),
+        ...(args.sessionId ? { resumeSessionId: args.sessionId } : {}),
         cwd: opts.cwd,
         watchdogMs: config.watchdog_ms,
         onPermission,
@@ -1082,7 +1177,7 @@ export async function startDaemon(opts: DaemonOptions) {
       let piReply: Envelope | undefined;
       const ctx: ToolContext = {
         cwd: opts.cwd, deny: config.local.deny,
-        sandboxProfile: profile(opts.cwd, config.local.bash_network, config.local.read_allow, config.local.deny),
+        sandboxProfile: profile(opts.cwd, config.local.bash_network, config.local.read_allow, config.local.deny, config.local.sandbox === "allow-default" ? "allow" : "deny"),
         permit: (title) => onPermission({ peer: "pi", title, options: [{ optionId: "allow", name: "Allow", kind: "allow_once" }, { optionId: "deny", name: "Deny", kind: "reject_once" }] }).then((picked) => picked === "allow" && pi.acceptingTools && bus.peers.get("pi") === pi),
         send: (text, to) => {
           if (to?.some((id) => !bus.peers.has(id) && id !== USER)) return "error: unknown peer";
@@ -1173,7 +1268,7 @@ export async function startDaemon(opts: DaemonOptions) {
         omni,
         ...(sidecar && route ? { sidecar, route } : {}),
         fixedModel: args.model ?? routing.local.fixed_model,
-        tools: { deny: config.local.deny, bashNetwork: config.local.bash_network, readAllow: config.local.read_allow, permit },
+        tools: { deny: config.local.deny, bashNetwork: config.local.bash_network, readAllow: config.local.read_allow, sandbox: config.local.sandbox, permit },
         ...(capture ? { capture } : {}),
         taskTool: (name, a, turn) => taskOp("local", name, a, true, turn.pii),
         turnPolicy: (envs) => tasks.turnPolicy(envs),
@@ -1619,6 +1714,8 @@ export async function startDaemon(opts: DaemonOptions) {
   }
   async function stopOnce(): Promise<void> {
     stopping = true;
+    // A stop someone asked for is not a crash, even if it then runs past the shutdown deadline: forget the sessions now.
+    try { removeSessions(opts.stateDir, instanceId); } catch { /* the state dir is gone */ }
     checksClosed = true;
     for (const kill of runningChecks) kill();
     log("hub stopping");
@@ -1674,7 +1771,14 @@ export async function startDaemon(opts: DaemonOptions) {
   writeStatus();
   log(`${RUN_START}${process.pid} control=127.0.0.1:${server.port} cwd=${opts.cwd}`);
   ready = true;
-  if (config.pi.enabled && config.pi.auto_start && !recoveryActive()) void startPeer("pi", {}).catch((error) => log(`Pi auto-start failed: ${error.message}`));
+  if (crashed) {
+    // This run owns the record now, so its clean stop removes it even if no peer attaches to rewrite it.
+    try { if (readSessions(opts.stateDir)?.instanceId === crashed.instanceId) writeSessions(opts.stateDir, { ...crashed, instanceId, at: Date.now() }); } catch (error) { log(`session record not adopted: ${(error as Error).message}`); }
+    void recoverAfterCrash(crashed).catch((error) => log(`crash recovery failed: ${(error as Error).message}`));
+  }
+  // Skipped only when crash recovery itself starts Pi again on its recorded session.
+  const piResumes = !!crashed && autoResume && crashPlan(crashed.peers).some((s) => s.peer === "pi" && s.resume);
+  if (config.pi.enabled && config.pi.auto_start && !recoveryActive() && !piResumes) void startPeer("pi", {}).catch((error) => log(`Pi auto-start failed: ${error.message}`));
   return { bus, token, port: server.port as number, stop, stopped: new Promise<void>((r) => (onStop = r)) };
   } finally {
     if (!ready) for (const cleanup of startupCleanup.reverse()) { try { cleanup(); } catch { /* preserve startup error */ } }

package/src/hub/hub-tools.ts

@@ -40,7 +40,7 @@ export const TASK_TOOLS: HubTool[] = [
   tool("hub_task_decline", "Pass on a task assigned to you; the hub offers it to the next peer.", { id, reason: str }, ["id"]),
   tool("hub_task_done", "Mark your task finished. It goes to its reviewer with your summary and refs. When the project configures a check for its class, the hub runs it first and the result comes as a task message: a failed check keeps the task with you.", { id, summary: { type: "string", description: "what changed, why, and the check you ran with its result" }, refs }, ["id", "summary"]),
   tool("hub_task_list", "The task board. PII tasks show as [pii].", { state: { type: "string", enum: ["proposed", "in_progress", "in_review", "approved", "changes_requested"] }, ready: { type: "boolean", description: "only proposed tasks with nothing left to wait for" } }),
-  tool("hub_review", "Give your verdict on a task you were asked to review. Two changes_requested in a row move the task to another peer.", { id, verdict: { type: "string", enum: ["approved", "changes_requested"] }, note: str }, ["id", "verdict"]),
+  tool("hub_review", "Give your verdict on a task you were asked to review: map the changed signatures and call sites to the task's plan or detail, read the check result, and list what is unmet. Two changes_requested in a row move the task to another peer.", { id, verdict: { type: "string", enum: ["approved", "changes_requested"] }, note: str, unmet: { type: "array", items: str, description: "each requirement of the plan or detail that the change does not meet" } }, ["id", "verdict"]),
   tool("hub_checkpoint", "Answer a checkpoint request from the hub (your quota window is nearly used up): what you were doing, what is half done, what whoever continues must know. Write the same to .agenthub/checkpoint.md first if you can.", { summary: str }, ["summary"]),
   tool("hub_remember", "Save a decision, finding, contract or fail to the memory all agents share (claude-mem); the other agents also get it with their next message. A fail is an approach you tried that does not work, and why: the most useful note, it stops the others spending their quota on it. Do not retry what a fail note rules out without new evidence. Conclusions worth recalling, not chatter.", { text: str, title: str, kind: { type: "string", enum: [...NOTE_KINDS] }, task: id }, ["text"]),
 ];

package/src/hub/routing.ts

@@ -135,6 +135,9 @@ export function assign(
     now?: number;
     /** Peers demoted for this task's class, with their recent failure weight (issue #36). */
     demoted?: Record<PeerId, number>;
+    /** Review record per implementer, then per reviewer, for this class (issue #35); followed only when `adaptive`. */
+    reviews?: Record<PeerId, Record<PeerId, { score: number; n: number }>>;
+    adaptive?: { min: number };
   } = {},
 ): Assignment {
   const policy = routing.classes[task.class];
@@ -177,10 +180,25 @@ export function assign(
     return out;
   };
   /** Demoted peers go behind the rest for this class (owners only); each group is then ordered by quota. */
-  const rank = (ok: PeerId[], role: "owner" | "reviewer"): PeerId[] => {
+  /** Reviewers with enough recorded reviews of this owner's work swap places by how those reviews held up. */
+  const byRecord = (list: PeerId[], owner: PeerId | undefined): PeerId[] => {
+    const record = owner ? opts.reviews?.[owner] : undefined;
+    if (!record || !Object.keys(record).length) return list;
+    trace.push(`  review record with ${owner} in ${task.class}: ${Object.entries(record).map(([r, s]) => `${r} ${s.n} reviews, ${Math.round(s.score * 100)}% held`).join("; ")}${opts.adaptive ? "" : " (review.adaptive is off)"}`);
+    if (!opts.adaptive) return list;
+    const known = (p: PeerId) => (record[p] && record[p].n >= opts.adaptive!.min ? record[p].score : undefined);
+    const slots = list.flatMap((p, i) => (known(p) === undefined ? [] : [i]));
+    const sorted = slots.map((i) => list[i]!).sort((a, b) => known(b)! - known(a)!);
+    const out = [...list];
+    slots.forEach((i, k) => (out[i] = sorted[k]!));
+    return out;
+  };
+  const rank = (ok: PeerId[], role: "owner" | "reviewer", owner?: PeerId): PeerId[] => {
     const down = role === "owner" ? ok.filter((p) => opts.demoted?.[p]) : [];
     if (down.length) trace.push(`  demoted for ${task.class}: ${down.map((p) => `${p} (${opts.demoted![p]!.toFixed(1)} recent failures)`).join(", ")}`);
-    return [...byDrain(ok.filter((p) => !down.includes(p))), ...byDrain(down)];
+    const ranked = [...byDrain(ok.filter((p) => !down.includes(p))), ...byDrain(down)];
+    // The review record comes after quota, so it decides among reviewers that have one: idle, then record, then quota.
+    return role === "reviewer" ? byRecord(ranked, owner) : ranked;
   };
 
   const pick = (list: PeerId[], role: "owner" | "reviewer", not?: PeerId): PeerId | undefined => {
@@ -190,7 +208,7 @@ export function assign(
       trace.push(`  ${role} candidate ${peer}: ${why ? `skipped, ${why}` : states[peer]}`);
       if (!why) ok.push(peer);
     }
-    const ranked = rank(ok, role);
+    const ranked = rank(ok, role, not);
     // Demotion applies to local and Pi too: a demoted one loses its place ahead of the cloud peers.
     const localTier = ranked.filter((p) => (p === LOCAL || p === PI) && !(role === "owner" && opts.demoted?.[p]));
     if (localTier.length) return localTier.find((p) => states[p] === "idle") ?? localTier[0]; // local/Pi stays ahead of an idle cloud peer

package/src/hub/tasks.ts

@@ -27,6 +27,8 @@ export interface TasksDeps {
   recordOverlap?: (task: number, owner: PeerId, others: { task: number; owner: PeerId; paths: string[]; symbols?: string[] }[]) => void;
   /** Quota per peer from fresh readings (issue #36): routing drains the windows that reset soonest first. */
   quota?: () => Record<PeerId, { headroom: number; resetsAt?: number }>;
+  /** Reviewer choice from recorded review outcomes (issue #35); off unless the project config turns it on. */
+  review?: { adaptive: boolean; min_reviews: number };
   /** Optional: name a class for a task proposed without one. `onCampus` says whether the model call stays on campus. */
   triage?: { classify: (title: string, detail: string) => Promise<TaskClass | undefined>; onCampus: () => Promise<boolean> };
 }
@@ -37,6 +39,8 @@ const ESCALATE_AFTER = 2;
 // ponytail: fixed constants; make them config when someone needs to tune them.
 const DEMOTION_HALF_LIFE_MS = 24 * 3_600_000;
 const DEMOTE_AT = 1.5;
+/** An approval counts as contradicted when work on the same places fails within this window (issue #35). */
+const CONTRADICTION_WINDOW_MS = 7 * 86_400_000;
 const OPEN: Task["state"][] = ["proposed", "in_progress", "changes_requested"];
 /** Board events that leave a task where its completion check found it; any other event means it moved on meanwhile. */
 const QUIET_EVENTS = new Set(["answer", "reviewer changed"]);
@@ -122,11 +126,56 @@ export class Tasks {
     return Object.fromEntries([...sums].filter(([, s]) => s.bad >= DEMOTE_AT && s.bad > s.good).map(([p, s]) => [p, s.bad]));
   }
 
-  /** What assignment weighs besides states and policy: quota and demotion. */
+  /** How each reviewer's reviews of each implementer's work in a class held up (issue #35). */
+  reviewRecord(cls: TaskClass): Record<PeerId, Record<PeerId, { score: number; n: number }>> {
+    // Counted per task: a review that asked for changes and then approved is one review, not two.
+    const c = new Map<string, { reviewed: Set<number>; contradicted: Set<number> }>();
+    for (const r of this.d.board.reviews({ class: cls })) {
+      const key = `${r.implementer}\0${r.reviewer}`;
+      const s = c.get(key) ?? { reviewed: new Set<number>(), contradicted: new Set<number>() };
+      (r.kind === "contradicted" ? s.contradicted : s.reviewed).add(r.task);
+      c.set(key, s);
+    }
+    const out: Record<PeerId, Record<PeerId, { score: number; n: number }>> = {};
+    for (const [key, s] of c) {
+      const [implementer, reviewer] = key.split("\0") as [PeerId, PeerId];
+      const n = s.reviewed.size;
+      if (n) (out[implementer] ??= {})[reviewer] = { score: (n - [...s.contradicted].filter((t) => s.reviewed.has(t)).length) / n, n };
+    }
+    return out;
+  }
+
+  /** Who asked for changes on the current owner's work: requests made before the task changed hands were about someone else's. */
+  private requestedChanges(task: Task): Set<PeerId> {
+    const since = task.history.findLastIndex((h) => ["assigned", "escalated", "reassigned", "unassigned"].includes(h.event));
+    return new Set(task.history.slice(since + 1).filter((h) => h.event === "changes_requested").map((h) => h.by));
+  }
+
+  /** What assignment weighs besides states and policy: quota, demotion and the review record. */
   private weights(cls: TaskClass) {
     const now = Date.now();
     const quota = this.d.quota?.();
-    return { now, demoted: this.demoted(cls, now), ...(quota ? { quota } : {}) };
+    return { now, demoted: this.demoted(cls, now), reviews: this.reviewRecord(cls), ...(quota ? { quota } : {}), ...(this.d.review?.adaptive ? { adaptive: { min: this.d.review.min_reviews } } : {}) };
+  }
+
+  /**
+   * Work on these places failed (a check failure, or changes requested): approvals of other tasks on the same places
+   * within the window were contradicted. Each approval counts once.
+   */
+  private contradict(failed: Task): void {
+    if (this.isPii(failed)) return; // its places are left out everywhere else too
+    const now = Date.now();
+    const mine = this.places(failed);
+    for (const t of this.d.board.list("approved")) {
+      if (t.id === failed.id || !t.owner || this.isPii(t)) continue;
+      const approval = [...t.history].reverse().find((h) => h.event === "approved");
+      if (!approval || now - approval.at > CONTRADICTION_WINDOW_MS || approval.by === USER) continue;
+      const theirs = this.places(t);
+      // Blame needs the same file or symbol: a directory or `.` would contradict every approval under it.
+      const same = mine.paths.some((p) => theirs.paths.includes(p)) || mine.symbols.some((x) => theirs.symbols.includes(x));
+      if (!same || this.d.board.reviews({ task: t.id }).some((r) => r.kind === "contradicted")) continue;
+      this.d.board.recordReview({ implementer: t.owner, reviewer: approval.by, class: t.class, kind: "contradicted", task: t.id });
+    }
   }
 
   async propose(by: PeerId, input: { title?: string; detail?: string; class?: string; refs?: TaskRefs; plan?: TaskPlan; owner?: PeerId; after?: unknown; urgent?: unknown }): Promise<Task> {
@@ -482,6 +531,7 @@ export class Tasks {
     }
     this.d.board.update(id, HUB, "check failed", {}, `${outcome}\n${result.tail}`.trim());
     if (task.owner) this.d.board.recordOutcome(task.owner, task.class, false);
+    this.contradict(task);
     this.d.notify(`task ${this.publicTitle(task)}: its check failed (${outcome}); it stays with ${task.owner ?? by}`);
     this.tell(task, `Task #${id}: its check failed.\n$ ${outcome}${result.tail ? `\n${result.tail}` : ""}\nFix it and call hub_task_done again.`, pii);
   }
@@ -531,19 +581,37 @@ export class Tasks {
     const r = task.refs;
     const last = [...task.history].reverse().find((h) => h.event === "done");
     const where = [r.branch ? `branch ${r.branch}` : "", r.commit ? `commit ${r.commit}` : "", r.paths?.length ? `paths ${r.paths.join(", ")}` : ""].filter(Boolean).join("; ");
-    const body = `Review task #${task.id} [${task.class}] ${task.title}\nDone by ${last?.by ?? task.owner}: ${last?.note ?? "(no summary)"}\n${where ? `Where: ${where}\n` : ""}${why ? `${why}\n` : ""}Give your verdict with hub_review {id: ${task.id}, verdict: "approved" | "changes_requested", note}.`;
+    // A checklist that maps the change to its contract (issue #35): reviewers who check against the written plan catch more.
+    const plan = planText(task.plan);
+    const check = [...task.history].reverse().find((h) => h.event === "check passed");
+    const checklist = [
+      "Checklist:",
+      `- Map the changed signatures and call sites to ${plan ? `the plan (${plan})` : task.detail ? "the task detail above" : "the task title"}, and name each one that does not match.`,
+      `- ${check ? `Check result: ${(check.note ?? "").split("\n")[0]}` : "No check ran for this class: run the affected tests yourself."}`,
+      `- List what is unmet in hub_review's unmet, one item each.`,
+    ].join("\n");
+    const body = `Review task #${task.id} [${task.class}] ${task.title}\nDone by ${last?.by ?? task.owner}: ${last?.note ?? "(no summary)"}\n${where ? `Where: ${where}\n` : ""}${why ? `${why}\n` : ""}${!plan && task.detail ? `Task detail:\n${task.detail}\n` : ""}${checklist}\nGive your verdict with hub_review {id: ${task.id}, verdict: "approved" | "changes_requested", note, unmet}.`;
     this.d.bus.publish(newEnvelope(HUB, body, { to: [reviewer], kind: "review", priority: "important", refs: { ...r, task: String(task.id) }, ...(this.isPii(task) ? { private: true } : {}) }));
   }
 
-  async review(by: PeerId, id: unknown, verdict: unknown, note?: string): Promise<Task> {
+  async review(by: PeerId, id: unknown, verdict: unknown, note?: string, unmet?: unknown): Promise<Task> {
     const task = this.need(id);
     this.mine(task, by, "reviewer");
     if (verdict !== "approved" && verdict !== "changes_requested") throw new Error('verdict must be "approved" or "changes_requested"');
     if (task.state !== "in_review") throw new Error(`task #${task.id} is ${task.state}: cannot move to ${verdict} before its owner calls hub_task_done`);
     const pii = this.isPii(task);
+    const items = textList(unmet);
+    if (items.length) note = `${note ?? ""}\nUnmet: ${items.join("; ")}`.trim();
     if (verdict === "approved") {
       const next = this.d.board.update(task.id, by, "approved", { state: "approved", rejections: 0 }, note);
-      if (next.owner) this.d.board.recordOutcome(next.owner, next.class, true);
+      if (next.owner) {
+        this.d.board.recordOutcome(next.owner, next.class, true);
+        this.d.board.recordReview({ implementer: next.owner, reviewer: by, class: next.class, kind: "approved", task: next.id });
+        // Changes requested on this owner's work and the redo passed: those reviews caught something.
+        for (const r of this.requestedChanges(task)) {
+          this.d.board.recordReview({ implementer: next.owner, reviewer: r, class: next.class, kind: "caught", task: next.id });
+        }
+      }
       this.note(next, by, "decision", `Task #${next.id} approved by ${by}: ${next.title}\n${note ?? ""}`);
       this.tell(next, `Task #${next.id} approved by ${by}.${note ? ` ${note}` : ""}`, pii);
       await this.releaseDependents(next);
@@ -551,6 +619,7 @@ export class Tasks {
     }
     const rejected = this.d.board.update(task.id, by, "changes_requested", { state: "changes_requested", rejections: task.rejections + 1 }, note);
     if (rejected.owner) this.d.board.recordOutcome(rejected.owner, rejected.class, false);
+    this.contradict(rejected);
     this.note(rejected, by, "decision", `Task #${rejected.id} changes requested by ${by}: ${rejected.title}\n${note ?? ""}`);
     if (rejected.rejections >= ESCALATE_AFTER) {
       const moved = await this.escalate(HUB, rejected.id, `${rejected.rejections} consecutive changes_requested`);
@@ -573,6 +642,8 @@ export class Tasks {
     // The hub's own escalations are not counted: after repeated changes_requested each one already was, and after a
     // Pi inference failure the backend failed, not the work. An escalation by hand counts on its own.
     if (from && by !== HUB) this.d.board.recordOutcome(from, task.class, false);
+    // Only a reviewer that asked for changes on this work saw it fail: not an escalation of unreviewed work (a Pi failure).
+    if (from && task.reviewer && task.reviewer !== USER && this.requestedChanges(task).has(task.reviewer)) this.d.board.recordReview({ implementer: from, reviewer: task.reviewer, class: task.class, kind: "escalated", task: task.id });
     const next = await this.assignOwner(task, by, { candidates: list, event: "escalated", note: `${why}; from ${from ?? "none"}`, context: why });
     if (next.owner && next.owner !== from) {
       this.d.notify(`task ${this.publicTitle(next)} escalated from ${from} to ${next.owner} (${why})`);

package/src/local/sandbox.ts

@@ -18,7 +18,19 @@ const q = sbplString;
  * no network unless asked. In SBPL the last matching rule wins, so the denies come last.
  */
 /** Toolchains and git identity: the only parts of the home directory a sandboxed command may read besides the project. */
-const HOME_READABLE = [".bun", ".cargo", ".rustup", ".local", ".npm", ".cache", ".pyenv", ".nvm", ".deno", "go", ".gitconfig", ".config/git", "Library/Caches"];
+const HOME_READABLE = [".bun", ".cargo", ".rustup", ".local", ".npm", ".cache", ".pyenv", ".nvm", ".deno", "go", ".gitconfig", ".config/git", "Library/Caches", ".volta", ".asdf", ".nodenv", ".rbenv", ".sdkman", "Library/Application Support/fnm", "Library/pnpm"];
+
+/**
+ * Public CA bundles: the name denies (`*.pem` for keys) also match these, and TLS needs them once network is on.
+ * Allowed after the denies, by exact path.
+ */
+const CA_BUNDLES = ["/private/etc/ssl/cert.pem", "/opt/homebrew/etc/ca-certificates/cert.pem", "/opt/homebrew/etc/openssl@3/cert.pem", "/usr/local/etc/ca-certificates/cert.pem", "/usr/local/etc/openssl@3/cert.pem"];
+
+/** The selected Xcode or Command Line Tools dir: the `/usr/bin` shims (git, clang, make, python3) run what is in it. */
+function developerDir(): string | undefined {
+  const out = spawnSync("xcode-select", ["-p"], { encoding: "utf8" });
+  return out.status === 0 && out.stdout.trim() ? out.stdout.trim() : undefined;
+}
 
 /** A submodule or worktree keeps its git dir outside the project; git needs it, minus the parts that execute or reconfigure. */
 function externalGitDirs(root: string): string[] {
@@ -28,28 +40,67 @@ function externalGitDirs(root: string): string[] {
   return [...new Set(dirs)].filter((d) => !d.startsWith(`${root}/`));
 }
 
-export function profile(cwd: string, network: boolean, readAllow: string[] = [], deny: string[] = []): string {
+/** The system directories a deny-default profile lets commands read and run from: dyld, frameworks, toolchains. */
+const SYSTEM_READABLE = ["/usr", "/bin", "/sbin", "/System", "/Library", "/opt", "/private/etc", "/private/var/db/timezone", "/private/var/db/dyld"];
+/**
+ * Directory lookups (users, groups), logging and notifications; plus name resolution and TLS trust when network is on.
+ * No brokers that act outside the sandbox: LaunchServices would let `open` start a browser with network, and
+ * SecurityServer would answer Keychain queries the credential-path denies are there to stop.
+ */
+const MACH_SERVICES = ["com.apple.system.opendirectoryd.libinfo", "com.apple.system.DirectoryService.libinfo_v1", "com.apple.system.logger", "com.apple.system.notification_center"];
+const NETWORK_MACH_SERVICES = ["com.apple.dnssd.service", "com.apple.trustd", "com.apple.trustd.agent", "com.apple.networkd"];
+
+/**
+ * `base` "deny" (issue #39) starts from `(deny default)` and allows only what commands need: running and reading the
+ * system, toolchain and project directories, writing the project and temp. "allow" is the profile of 0.9 and earlier,
+ * kept for one release behind `local.sandbox: "allow-default"`. The denies at the end apply to both.
+ */
+export function profile(cwd: string, network: boolean, readAllow: string[] = [], deny: string[] = [], base: "deny" | "allow" = "deny"): string {
   const home = homedir();
   const inHome = (p: string) => (p.startsWith("~/") ? join(home, p.slice(2)) : p);
   const root = realPath(cwd);
   const tmp = realPath(tmpdir());
   const gitDirs = externalGitDirs(root);
   const creds = [".ssh", ".aws", ".gnupg", ".config/gh", ".config/gcloud", ".kube", ".docker", ".netrc", ".npmrc", ".omniroute", ".claude", ".codex", ".kimi-code", "Library/Keychains"];
+  const dev = developerDir();
+  const readable = [root, ...HOME_READABLE.map((p) => join(home, p)), ...readAllow.map(inHome), ...gitDirs, ...(dev ? [dev] : [])];
+  const subpaths = (paths: string[]) => paths.map((p) => `(subpath ${q(p)})`).join(" ");
+  const globals = (names: string[]) => names.map((n) => `(global-name ${q(n)})`).join(" ");
+  const start = base === "deny"
+    ? [
+        "(deny default)",
+        "(allow process-fork)",
+        // Runs from the system, toolchain and project directories only; a script runs through an allowed interpreter.
+        `(allow process-exec ${subpaths([...SYSTEM_READABLE, ...readable, tmp, "/private/tmp"])})`,
+        "(allow signal (target same-sandbox))",
+        "(allow process-info* (target same-sandbox))",
+        "(allow sysctl-read)",
+        `(allow mach-lookup ${globals([...MACH_SERVICES, ...(network ? NETWORK_MACH_SERVICES : [])])})`,
+        '(allow ipc-posix-shm-read-data ipc-posix-shm-read-metadata (ipc-posix-name "apple.shm.notification_center"))',
+        "(allow file-read-metadata)",
+        `(allow file-read* (literal "/") ${subpaths([...SYSTEM_READABLE, tmp, "/private/tmp", "/dev"])} ${subpaths(readable)})`,
+        '(allow file-ioctl (regex #"^/dev/"))',
+        ...(network ? ["(allow network*)"] : []),
+      ]
+    : [
+        "(allow default)",
+        ...(network ? [] : ["(deny network*)"]),
+        // Home is default-deny for reads: whatever a command reads can end up in the model's answer, and that answer
+        // is shared with agents that run on cloud subscriptions (~/.claude.json, app tokens, browser profiles ...).
+        `(deny file-read* (subpath ${q(home)}))`,
+        `(allow file-read-metadata (subpath ${q(home)}))`,
+        `(allow file-read* ${subpaths(readable)})`,
+      ];
   return [
     "(version 1)",
-    "(allow default)",
-    ...(network ? [] : ["(deny network*)"]),
-    // Home is default-deny for reads: whatever a command reads can end up in the model's answer, and that answer
-    // is shared with agents that run on cloud subscriptions (~/.claude.json, app tokens, browser profiles ...).
-    `(deny file-read* (subpath ${q(home)}))`,
-    `(allow file-read-metadata (subpath ${q(home)}))`,
-    `(allow file-read* (subpath ${q(root)}) ${[...HOME_READABLE.map((p) => join(home, p)), ...readAllow.map(inHome), ...gitDirs].map((p) => `(subpath ${q(p)})`).join(" ")})`,
+    ...start,
     "(deny file-write*)",
     `(allow file-write* (subpath ${q(root)}) (subpath ${q(tmp)}) (subpath "/private/tmp") (regex #"^/dev/") ${gitDirs.map((d) => `(subpath ${q(d)})`).join(" ")})`,
     // Inside cwd: nothing that runs later outside the sandbox, nothing that reconfigures the hub.
     `(deny file-write* (subpath ${q(join(root, ".agenthub"))}) ${[join(root, ".git"), ...gitDirs].map((d) => `(subpath ${q(join(d, "hooks"))}) (literal ${q(join(d, "config"))})`).join(" ")})`,
     `(deny file-read* file-write* ${creds.map((c) => `(subpath ${q(join(home, c))})`).join(" ")})`,
     `(deny file-read* file-write* ${denyRegexes(root, deny).join(" ")})`,
+    ...(network ? [`(allow file-read* ${CA_BUNDLES.map((p) => `(literal ${q(p)})`).join(" ")})`] : []),
   ].join("\n");
 }
 

package/templates/config.json

@@ -23,10 +23,13 @@
     "cf_client_id_file": "",
     "cf_client_secret_file": ""
   },
-  "local": { "deny": [], "bash_network": false, "max_steps": 30, "read_allow": [] },
+  "local": { "deny": [], "bash_network": false, "max_steps": 30, "read_allow": [], "sandbox": "deny-default" },
   "approvals": { "timeout_s": 120 },
   "tasks": { "release_after_min": 30 },
   "checks": { "timeout_s": 600 },
   "snapshots": { "enabled": true, "keep": 20 },
+  "review": { "adaptive": false, "min_reviews": 5 },
+  "recovery": { "auto_resume_after_crash": false },
+  "capabilities": {},
   "limits": { "sender_per_min": 12, "pair_per_min": 6, "important_per_hour": 6, "repeat_window_s": 120 }
 }