@timurproko/a1 0.2.6-dev.736 → 0.2.7-dev.1221

package/docs/architecture/evidence/terminal-host-spike/terminal-host-task-5-1.json

@@ -0,0 +1,56 @@
+{
+  "schema": "a1-terminal-host-task-5-1-v1",
+  "recordedAt": "2026-08-20T09:25:48.307Z",
+  "change": "evolve-bare-a1-into-multi-agent-workspace",
+  "task": "5.1",
+  "hostMode": "console-inside-existing-terminal",
+  "desktopWindowCreated": false,
+  "fullscreenRun": "not-run-user-controlled-only",
+  "toolchain": {
+    "rust": "1.97.1",
+    "cargo": "1.97.1",
+    "zig": "0.15.2",
+    "platform": "win32",
+    "architecture": "x64"
+  },
+  "artifact": {
+    "path": "native/terminal-host/target/debug/a1-terminal-host.exe",
+    "profile": "debug",
+    "sha256": "d1437d46d469a8823565a0428b57a1888bb327c2ce26d3cb51c0fb6fc88e4165",
+    "sizeBytes": 2394624
+  },
+  "source": {
+    "cargoTomlSha256": "8c6510f8d758189f24f91c1f044e93902a376e3c1a5bb71ca747603f03f0cc72",
+    "cargoLockSha256": "ec023df443170affda1ce69ddaa9489785fed1347d97bcb44a793607e61a20a2",
+    "buildScriptSha256": "54befce9dd9b1fbfadb388d8c4d1c97e1d6473660a075b7acc6baaddf54301c7",
+    "mainSha256": "6180f21f4dcfc0e1a8a4808a4312957eaff7bc7342660b3d449e8ea7ee164eed",
+    "ghosttyBindingSha256": "31747a4c5a4214059cea1d2ccab0b6245e74e05d5da3188271be4b331acb9231",
+    "libghosttyVtCommit": "c5a21edfcbc2d5b46540ad91b7980aca31f5f1f3",
+    "libghosttyVtLicenseSha256": "3129de97bc7769d683e52ce02cb4eaecd2b0aab144b09d6325a1b135bdc87cc0",
+    "portablePtyVersion": "0.9.0",
+    "crosstermVersion": "0.29.0"
+  },
+  "commands": [
+    {
+      "command": "cargo clean && npm run test:terminal-host",
+      "result": "passed"
+    },
+    {
+      "command": "a1-terminal-host.exe --version",
+      "result": "passed"
+    },
+    {
+      "command": "a1-terminal-host.exe --probe",
+      "result": "passed",
+      "detail": "created a retained terminal model, composed a frame, started cmd.exe through a PTY, waited for exit, and cleaned up without entering alternate-screen mode"
+    }
+  ],
+  "limitations": [
+    "No fullscreen interactive run was launched by the agent.",
+    "No user input or physical rendering acceptance is claimed.",
+    "One-pane manual terminal validation remains user-controlled.",
+    "Isolated-worker physical automation remains deferred."
+  ],
+  "passed": true,
+  "sourceCommit": "b26383ed6605b222d6b853eb232c6b94e0fdb7ff"
+}

package/docs/architecture/evidence/terminal-host-spike/terminal-host-task-5-3.json

@@ -0,0 +1,174 @@
+{
+  "schema": "a1-terminal-host-task-5-3-v1",
+  "recordedAt": "2026-08-20T09:25:48.307Z",
+  "change": "evolve-bare-a1-into-multi-agent-workspace",
+  "task": "5.3",
+  "sourceCommit": "b26383ed6605b222d6b853eb232c6b94e0fdb7ff",
+  "artifact": {
+    "path": "native/terminal-host/target/debug/a1-terminal-host.exe",
+    "profile": "debug",
+    "sha256": "d1437d46d469a8823565a0428b57a1888bb327c2ce26d3cb51c0fb6fc88e4165",
+    "sizeBytes": 2394624
+  },
+  "toolchain": {
+    "rust": "1.97.1",
+    "cargo": "1.97.1",
+    "zig": "0.15.2",
+    "platform": "win32",
+    "architecture": "x64"
+  },
+  "authority": {
+    "owner": "native-terminal-host",
+    "nodeRelay": false,
+    "rawPayloadExported": false,
+    "outerPresentationBufferedInNativeHost": true,
+    "controlPlanePayloads": "typed identity, topology, capability, lifecycle, recovery, and bounded diagnostics only"
+  },
+  "identityObservation": {
+    "schema": "a1-terminal-host-hot-path-v1",
+    "paneCount": 4,
+    "streamIdentities": [
+      1,
+      8,
+      15,
+      22
+    ],
+    "inputIdentities": [
+      2,
+      9,
+      16,
+      23
+    ],
+    "terminalModelIdentities": [
+      3,
+      10,
+      17,
+      24
+    ],
+    "renderDamageIdentities": [
+      4,
+      11,
+      18,
+      25
+    ],
+    "keyEncoderIdentities": [
+      5,
+      12,
+      19,
+      26
+    ],
+    "mouseEncoderIdentities": [
+      6,
+      13,
+      20,
+      27
+    ],
+    "selectionIdentities": [
+      7,
+      14,
+      21,
+      28
+    ],
+    "allIdentitySetsUnique": true,
+    "presentationWrites": 2,
+    "presentationBytes": 4618,
+    "panes": [
+      {
+        "paneId": "pane-1",
+        "sessionId": "session-1",
+        "ptyOutputChunks": 8,
+        "ptyOutputBytes": 272,
+        "terminalModelWrites": 8,
+        "terminalModelBytes": 272,
+        "inputWrites": 2,
+        "inputBytes": 23,
+        "renderPasses": 2,
+        "renderedBytes": 642
+      },
+      {
+        "paneId": "pane-2",
+        "sessionId": "session-2",
+        "ptyOutputChunks": 8,
+        "ptyOutputBytes": 272,
+        "terminalModelWrites": 8,
+        "terminalModelBytes": 272,
+        "inputWrites": 2,
+        "inputBytes": 23,
+        "renderPasses": 2,
+        "renderedBytes": 668
+      },
+      {
+        "paneId": "pane-3",
+        "sessionId": "session-3",
+        "ptyOutputChunks": 9,
+        "ptyOutputBytes": 272,
+        "terminalModelWrites": 9,
+        "terminalModelBytes": 272,
+        "inputWrites": 2,
+        "inputBytes": 23,
+        "renderPasses": 2,
+        "renderedBytes": 698
+      },
+      {
+        "paneId": "pane-4",
+        "sessionId": "session-4",
+        "ptyOutputChunks": 8,
+        "ptyOutputBytes": 272,
+        "terminalModelWrites": 8,
+        "terminalModelBytes": 272,
+        "inputWrites": 2,
+        "inputBytes": 23,
+        "renderPasses": 2,
+        "renderedBytes": 726
+      }
+    ]
+  },
+  "nativePrimitiveProbe": {
+    "keyEncoding": true,
+    "textImeEncoding": true,
+    "mouseEncoding": true,
+    "paneRelativeMouse": true,
+    "selection": true,
+    "clipboardOsc52Encoding": true,
+    "keyAndMouseModesRefreshedFromRetainedTerminal": true,
+    "nodeRelay": false
+  },
+  "staticBoundaryChecks": {
+    "nodeProtocolHotPathPayloadsAbsent": true,
+    "nativeImplementationDependenciesAbsentFromNodeManifest": true,
+    "probeRunnerUsesInheritedStdio": true,
+    "explicitTransparentModesRemainIndependent": true
+  },
+  "commands": [
+    {
+      "command": "npm run test:terminal-host",
+      "result": "passed"
+    },
+    {
+      "command": "npm run check:architecture",
+      "result": "passed"
+    },
+    {
+      "command": "npx vitest run test/repository-governance/native-host-boundary.test.ts test/repository-governance/terminal-architecture-policy.test.ts",
+      "result": "38 tests passed"
+    },
+    {
+      "command": "npm test",
+      "result": "285 tests passed"
+    },
+    {
+      "command": "npm run typecheck",
+      "result": "passed"
+    },
+    {
+      "command": "openspec validate evolve-bare-a1-into-multi-agent-workspace --strict",
+      "result": "passed"
+    }
+  ],
+  "limitations": [
+    "No physical terminal automation was run on the active workstation.",
+    "The text/IME gate validates the native composed-Unicode input path; operating-system IME behavior remains a task 5.4/5.5 physical workload where supported.",
+    "High-rate workloads, resource and latency measurements, abnormal exits, and exact-artifact physical acceptance remain tasks 5.4 and 5.5."
+  ],
+  "passed": true
+}

package/docs/architecture/evidence/terminal-host-spike/terminal-spike-acceptance-record.json

@@ -0,0 +1,18 @@
+{
+  "schema": "a1-terminal-spike-acceptance-record-v1",
+  "recordedAt": "2026-08-14T07:12:07.445Z",
+  "change": "evolve-bare-a1-into-multi-agent-workspace",
+  "hostMode": "console-inside-existing-terminal",
+  "artifact": null,
+  "technicalVerdict": "pending",
+  "physicalVerdict": "pending",
+  "physicalMethod": "not-run",
+  "decision": "pending",
+  "integrationAllowed": false,
+  "milestoneMergeAllowedForComposedTerminal": false,
+  "waivers": [],
+  "waiverPolicy": "no-waivers-after-evidence",
+  "structuredWorkIndependent": true,
+  "transparentModesIndependent": true,
+  "notes": "Acceptance is pending the isolated in-terminal 2x2 spike artifact and a manual or isolated-worker physical verdict."
+}

package/docs/architecture/internal-naming.md

@@ -31,7 +31,7 @@ The exact externally branded key/member authority is `config/internal-naming-pol
 | `A1_PROCESS_GUARDIAN_PATH` | Explicit executable override in `src/foundation/process-containment/native-guardian-containment.ts`, also configured by CI; exact existing exposure-review entry. |
 | `A1_PROBE_TRACE` | Opt-in diagnostics read by native terminal-host code; exact existing exposure-review entry. |
 | `A1_BUILD_VERBOSE`, `A1_DEV_SHELL` | Developer invocation controls in the build helper and development launcher; exact existing exposure-review entries. |
-| `A1_PANE_ID`, `A1_TERMINAL_SESSION_ID` | Produced by `native/terminal-host/src/workspace.rs` and exported to launched programs; external integration names, unchanged. |
+| `A1_PANE_ID`, `A1_TERMINAL_SESSION_ID` | Reserved compatibility identities retained in the product identity manifest; the resident host does not currently emit them. |
 
 Pending review preserves a possible external interface, not an obsolete private alias. Once a setting is established as private, it cannot keep its branded spelling through that category.
 
@@ -47,6 +47,8 @@ Pending review preserves a possible external interface, not an obsolete private
 | `RELEASE_RUNNER_LABEL` | Release/full-regression workflows supply certification-runner provenance to `run-release-gates.mjs`. |
 | `TERMINAL_FIXTURE_INPUT`, `TERMINAL_FIXTURE_TOKEN` | Native terminal probe producer/consumer in `native/terminal-host/src/main.rs`; expected input and fixture token. |
 | `TERMINAL_HOST_LOCAL_BUILD` | Developer shell sets exactly `1`; `native/terminal-host/build.rs` then permits a Windows build outside CI. |
+| `TERMINAL_HOST_EXPORT_VT` | Native validation lanes in `.github/workflows/ci.yml` name a directory; `build.rs` copies the linked terminal library, headers, and manifest there for upload. |
+| `TERMINAL_HOST_PREBUILT_VT` | Developer shell names a fetched library directory; with `TERMINAL_HOST_LOCAL_BUILD=1` and no `CI`, `build.rs` verifies its manifest and links it instead of running Zig. |
 | `DOCS_AUTO_MERGE_POLL_ATTEMPTS`, `DOCS_AUTO_MERGE_POLL_MS` | Documentation automation polling controls, produced by governance tests and consumed by `manage-documentation-auto-merge.mjs`. |
 | `VALIDATION_JOB_STARTED_MS`, `RENDERING_JOB_STARTED_MS` | CI timing handoffs within `.github/workflows/ci.yml`; epoch milliseconds. |
 | `RUN_PROCESS_CONTAINMENT_INTEGRATION` | CI enables the real containment fixture with exactly `1`; platform containment tests consume it. |

package/docs/architecture/process-guardian-provenance.md

@@ -1,27 +1,35 @@
 # Process guardian provenance
 
-A1 launch-instance containment uses a standalone native executable named `process-guardian`. The approved implementation is a separate Rust crate at `native/process-guardian`; it is not a Node-API addon and does not reuse or resume the held composed terminal-host implementation.
+A1 launch-instance containment uses the Node-API 9 addon `process-guardian.node`. The approved implementation is the separate Rust crate at `native/process-guardian`; it produces no product executable. The foreground Node launch guardian loads the addon and holds the containment boundary in-process.
 
 ## Boundary
 
-The executable owns platform process containment and launches one immutable `a1-ui` runtime with inherited terminal handles. It does not create a PTY, read ordinary terminal input, capture or parse runtime output, render, or relay terminal bytes. Its private parent/child coordination is restricted to bounded lifecycle and identity data.
+The addon owns platform process containment and launches one immutable A1 UI runtime with inherited terminal handles. It also provides native process-start inspection, terminal-mode capture and restoration, exit-notice delivery, and the bounded process-wait and process-group operations used by the exit watcher. It does not create a PTY, read ordinary terminal input, capture or parse runtime output, render, or relay terminal bytes.
 
-On Windows it uses `windows-sys 0.61.2` to create a Job Object, enables `JOB_OBJECT_LIMIT_KILL_ON_JOB_CLOSE`, assigns the runtime before resuming it, denies silent breakaway by never enabling breakaway limits, monitors the verified Node parent process, and terminates remaining job members after root or parent exit.
+On Windows it uses `windows-sys 0.61.2` to create a Job Object, enables `JOB_OBJECT_LIMIT_KILL_ON_JOB_CLOSE`, and creates the runtime directly in that job through `PROC_THREAD_ATTRIBUTE_JOB_LIST`. The runtime is a job member from its first instruction; the former suspended-create, assign, and resume sequence is gone. Ordinary jobs do not enable breakaway, and closing the addon-held job handle terminates remaining members.
 
-On Linux and macOS it creates a dedicated POSIX process group before exec, transfers foreground-terminal ownership only when a terminal is present, monitors the verified parent, applies bounded TERM/KILL cleanup to that group, and restores the prior foreground group. Linux derives process start identity from procfs. macOS derives it from the native `proc_pidinfo(PROC_PIDTBSDINFO)` start timestamp; PID liveness alone is never treated as identity.
+On Linux and macOS it uses `posix_spawn` to create a dedicated process group, transfers foreground-terminal ownership only when a terminal is present, applies bounded TERM/KILL cleanup to that group, and restores the prior foreground group. Linux derives process start identity from procfs. macOS derives it from `proc_pidinfo(PROC_PIDTBSDINFO)`; PID liveness alone is never treated as identity.
+
+## Exit watcher
+
+After the contained runtime starts, the launch guardian starts `dist/foundation/launch-guardian/exit-watcher.js` in another Node runtime outside the guardian's containment. The watcher waits for the guardian, performs bounded Unix process-group cleanup when needed, and claims and delivers the armed exit notice with the captured terminal modes. On Windows the addon creates that Node process outside both the runtime job and the guardian's inherited job; on Unix it remains in the terminal session so terminal hang-up reaches it naturally. The guardian itself delivers the notice on ordinary completion, and claim-by-rename ensures only one owner can print it.
+
+There is one accepted gap: a machine-wide kill aimed at every Node process, such as `taskkill /IM node.exe` or `pkill node`, kills the watcher together with the guardian and runtime. No exit notice is then printed and, on Unix, non-Node descendants left in the runtime process group are not signalled by the watcher. A1 does not work around that case by starting an A1-built executable. Terminal closure, `Ctrl+Break`, guardian failure, runtime termination, and a kill aimed only at the guardian remain covered.
 
 ## Artifact contract
 
-Release builds place the exact executable at:
+Release builds place the addon at:
 
 ```text
-dist/native/win32-x64/process-guardian.exe
-dist/native/linux-x64/process-guardian
-dist/native/darwin-x64/process-guardian
-dist/native/darwin-arm64/process-guardian
+dist/native/win32-x64/process-guardian.node
+dist/native/linux-x64/process-guardian.node
+dist/native/darwin-x64/process-guardian.node
+dist/native/darwin-arm64/process-guardian.node
 ```
 
-Each supported artifact must be named in the release integrity manifest with target triple, crate version, guardian protocol version, SHA-256, byte size, build provenance, and signature/attestation status. The build marks a platform supported only after its native containment integration runs on that platform. A missing, altered, incompatible, unsupported, or wrong-platform artifact is a concise containment launch error; A1 never silently falls back to PID-only cleanup.
+The publication `guardians` job builds them on `windows-2025`, `ubuntu-24.04`, and `macos-15` arm64; the macOS arm64 job also cross-compiles x64 with `--target x86_64-apple-darwin`. A native build is identified by loading the addon into Node and reading `version()`. When the producing runner cannot load the cross-compiled x64 addon, its manifest records only the observed Mach-O architecture.
+
+Each `a1-process-guardian-artifact-v2` manifest records `kind: "node-addon"`, Node-API 9, target platform and architecture, crate and protocol versions, SHA-256, byte size, build provenance, and signature/attestation status. A supported artifact is verified before loading. A missing, altered, incompatible, unsupported, or wrong-platform artifact is a concise containment launch error; A1 never silently falls back to PID-only cleanup. If a certified immutable release file disappears or changes, bootstrap restores it only from a matching installed package whose source bytes reproduce the certified size and digest, then verifies the complete release again.
 
 ## Licensing
 

package/docs/architecture/project-structure.md

@@ -103,6 +103,14 @@ a1 session link-worktree <absolute-worktree>
 git -C .worktrees/<task-id> status
 ```
 
+Claude Code sessions have no A1 shell-tool session, so they link with Claude Code's `EnterWorktree` tool by task name. The tracked `.claude/settings.json` wires a `WorktreeCreate` hook, `scripts/governance/claude-worktree-create.mjs`, that creates `.worktrees/<task-id>` detached at fresh `origin/develop`, or returns it when it is already registered, so Claude Code anchors the session there without an approval prompt. The agent then creates the task branch inside it:
+
+```sh
+git -C .worktrees/<task-id> switch -c <type>/<short-description>
+```
+
+Passing an absolute `path` to `EnterWorktree` is reserved for a worktree created by hand, from the primary checkout, before any shell command in that session; Claude Code otherwise keeps its shell tools anchored to the primary checkout and refuses their commands. The matching `WorktreeRemove` hook declines removal, so sessions leave with `ExitWorktree` `keep` and worktrees are removed only by the cleanup tool.
+
 Inventory is read-only and advisory because another runtime may win a later race. A successful link response confirming the exact canonical worktree is required before planning, implementation, test, or delivery-documentation edits. If inventory or linking fails, reports a live/unverifiable owner, loses a race, or confirms another path, stop task edits and report the blocker; use a separate fresh worktree rather than overriding, unlinking, or recovering that owner. A session resuming an existing delivery or switching streams atomically claims and links the exact worktree before editing it.
 
 The link acquires a cooperative live-session editing claim and switches bare A1's footer repository context and pull-request discovery. It does not change process or tool cwd, create a Git worktree lock, or register, release, or authorize cleanup. Clean unlink/disposal releases live editing authority; a crashed owner becomes reusable only after exact process death is verified. Repository commands therefore keep an explicit worktree path. The primary worktree stays on `develop` for integration and must not be used for task edits. Do not edit, adopt, move, or remove another session's worktree.

package/docs/architecture/resident-tabs-requirements.md

@@ -0,0 +1,18 @@
+# Resident tabs — target requirements
+
+Status: one requirement remains outside the delivered milestones. Milestones 1–6 moved every other requirement into their OpenSpec changes, and the canonical specs now hold them. This file keeps only what no milestone has delivered yet; it binds nothing until a later change adopts it. See [`resident-tabs.md`](resident-tabs.md#roadmap).
+
+## Capability: `resident-terminal-host`
+
+### ADDED Requirements
+
+#### Requirement: Host topology mutations are revisioned and atomic
+Client/server topology messages SHALL use the generation-1 protocol established by `resident-tabs-contracts`. A topology subscription SHALL begin with one complete snapshot and monotonic revision, followed by ordered changes. Every create, rename, reorder, close, retry, fresh-start, and stop-all mutation SHALL carry its expected topology or registry revision and SHALL either commit completely at the next revision or be rejected without a partial change. A method absent from an older same-generation server SHALL disable only that operation.
+
+##### Scenario: Two clients mutate one revision
+- **WHEN** two clients submit topology mutations against the same expected revision
+- **THEN** at most one SHALL commit, the stale mutation SHALL receive a typed revision conflict, and every client SHALL converge on the committed topology
+
+##### Scenario: Newer client calls an unavailable method
+- **WHEN** a newer same-generation client attaches to an older server that lacks one optional topology method
+- **THEN** attachment and unrelated operations SHALL remain available while only that method is disabled