@wacando/agent 0.0.0-stage → 2.0.0-rc.1

package/docs/CURSOR_IDENTITY_RESUME.md

@@ -0,0 +1,579 @@
+# Cursor identity resume — issue 2
+
+Status: shutdown regression and **issue #2 runtime acceptance checks PASS**.
+King's explicit decision, relayed in mission
+`1dc1a826-eefb-4610-bdfa-5027f88ab4d0`, accepts identity resume and revocation
+proved by all three runtime profiles against real API/Postgres/ejabberd/OMEMO.
+**Actual Cursor/Codex/Claude CLIs are NOT QUALIFIED in this sandbox**; their
+qualification is tracked in [Wacando #17](https://github.com/lbframe/wacando/issues/17).
+The recorded Cursor/Codex EROFS failures remain residual limitations, never PASS.
+This decision changes the acceptance scope, not the observed test results.
+Independent review is pending. No package was published and no lock was removed
+in order to obtain a successful resume.
+
+## Demonstrated defect and scope
+
+Base: `d0cf8b2` (`origin/main`). Linux, Node.js 22.22.0, npm 11.11.1.
+Installed host versions observed: Cursor Agent CLI `2026.09.26-dd393fe`, Codex
+CLI `0.162.1`. Neither host was used to claim an actual API/XMPP resume in this run.
+
+The MCP server used to arm an unconditional `process.exit(0)` one second after
+EOF/SIGTERM. `OnboardingService` releases a live session's exclusive `.lock` only
+**after** `session.stop()` resolves. The checked-in `@xmpp/client` implementation
+can wait two seconds closing the stream and another two closing the socket.
+Thus normal shutdown can exit successfully before releasing its session lock.
+The same deadline can interrupt saving an installation response after redemption.
+
+The regression test holds session cleanup behind a controlled barrier for 1.2
+seconds, crosses the old deadline, then allows the owner to release its own lock.
+It generates real OMEMO local state, compares it byte for byte after cleanup, and
+reacquires the released lock. A separate test holds an actual loopback HTTP
+verification response until after the old deadline and checks it is saved before
+exit. These are process/storage lifecycle tests. The session stop barrier does
+not simulate or qualify the XMPP contract.
+
+All three fail against an isolated archive of the base with exit code 1; both
+session cases observe the child exiting with code 0 before cleanup. All pass in
+the final full suite. This demonstrates a local shutdown defect consistent with
+the production report, **not proof that it was the cause of that particular
+Cursor host failure**. A held prior process, shutdown timing, or another host
+issue must still be distinguished using the actual host checker and approved API.
+
+## Change
+
+- Wait for onboarding cleanup and any currently dispatched call before applying
+  the final one-second stdout deadline. A separate 45-second cap exits with code
+  1 if cleanup cannot finish. It never reaps or bypasses a lock.
+- Wait for in-flight background recovery on close and avoid opening/publishing a
+  new session after close was requested. Keep the existing credentials, host/origin
+  partition, key paths and exclusive locking.
+- Regenerate all three plugin runtimes with the build; generated files were not
+  edited directly.
+- Bring the isolated host checker protections from the historical public fixture
+  into the normal loopback checker: isolated Cursor workspace alias, own process
+  group cleanup, parsed affirmative `verified: true` / `connected: true`, private
+  identity equality, and clear rejection after owner revocation. Cursor's outer
+  success/isError flag alone is insufficient. Raw host output is suppressed.
+
+The checker fails if its own descendants cannot close within ten seconds. Any
+forced termination is a failed qualification, never a successful retry with a
+removed lock. The checker remains loopback-only; no public acceptance bypass was
+added. Its event parser tests use explicit synthetic wrappers, not recorded host
+payloads from a real acceptance run.
+
+## Original implementation commands and real outputs
+
+The repository contains no separate lint/typecheck scripts. `npm run check`
+builds, checks generated output and runs all Node tests. Full suites were bounded
+by `timeout 600s` and run in the foreground.
+
+Baseline reproduction, from the plugin checkout:
+
+```sh
+baseline_dir=$(mktemp -d /tmp/wacando-issue2-before.XXXXXX)
+git archive origin/main | tar -x -C "$baseline_dir"
+cp tests/onboarding-shutdown.test.mjs "$baseline_dir/tests/onboarding-shutdown.test.mjs"
+cd "$baseline_dir"
+timeout 600s node --test tests/onboarding-shutdown.test.mjs
+```
+
+Actual isolated directory: `/tmp/wacando-issue2-before.56NFHw`. Exit 1.
+[Complete baseline output](evidence/issue-2/baseline.txt):
+
+```text
+# tests 3
+# suites 0
+# pass 0
+# fail 3
+# cancelled 0
+# skipped 0
+```
+
+Original full check before the approved API target, from the plugin checkout:
+
+```sh
+npm_config_cache=/tmp/wacando-issue2-npm-cache timeout 600s npm run check
+```
+
+Exit 0. [Complete output](evidence/issue-2/check.txt):
+
+```text
+# tests 57
+# suites 0
+# pass 54
+# fail 0
+# cancelled 0
+# skipped 3
+# todo 0
+```
+
+This includes Cursor/Codex cleanup and key preservation, in-flight verification
+and background recovery cleanup, parsed result validation, and both packaged
+MCP runtimes rejecting a locally revoked identity while still answering `ping`
+and exiting with code 0. Existing injected control-plane rejection tests cover
+HTTP 403/AGENT_REVOKED, but are not a real remote revocation check.
+
+The first check attempt used the default npm cache and failed the packaging test:
+`EROFS` opening `/home/kyle/.npm/_cacache/tmp/da3aeb1a`. No application test failure
+was inferred from that sandbox restriction; the final run used the writable
+cache above. An intermediate new background-recovery test also failed because
+its simulated scheduler retained an already-executed timer in the test's Set;
+the fixture now consumes it before calling the callback. The final output is
+from the corrected test, with no retry of a live identity.
+
+```sh
+npm_config_cache=/tmp/wacando-issue2-npm-cache timeout 600s npm run check:mcp
+```
+
+Exit 0. [Complete output](evidence/issue-2/check-mcp.txt):
+
+```text
+Official Inspector 2.7.0 passed: wacando
+Official Inspector 2.7.0 passed: wacando-cursor
+Official Inspector 2.7.0 passed: wacando-claude
+```
+
+```sh
+npm run build
+npm run check:generated
+git diff --check
+```
+
+Exit 0 for each. Real output:
+
+```text
+Built self-contained codex plugin: wacando@1.0.0
+Built self-contained cursor plugin: wacando-cursor@1.0.0
+Built self-contained claude plugin: wacando-claude@1.0.0
+Verified exact runtime: wacando
+Verified exact runtime: wacando-cursor
+Verified exact runtime: wacando-claude
+```
+
+`git diff --check` produced no output for the then-uncommitted changes.
+This historical working-tree check does not cover the cumulative PR diff;
+see the whitespace scope correction in the documentary follow-up evidence.
+
+## Approved local qualification — October 15, 2026
+
+King authorized an ephemeral local development target, relayed by
+`wacando.lead`. This run used Wacando `origin/main` at
+`66c754756e83e8685d61e1c0312b690d77b3bdd3`, in the detached checkout
+`/home/kyle/timon-projects/wacando/agent2-api`. No service source, frozen document,
+production/public service, account credential or issue-10 service was changed.
+The existing plugin branch and shutdown-lock regressions were retained.
+
+The target derives from `docker-compose.dev.yml`, uses the repository's API,
+policy and web Dockerfiles, and injects the official `ejabberd.ci.yml` and dev
+seed. The seed's container selector was restricted to this project's service;
+the original ancestor-image selector could otherwise select issue 10.
+
+| Service | Loopback host port | Container port |
+| --- | --- | --- |
+| Postgres | 25432 | 5432 |
+| ejabberd c2s / WebSocket / component | 25222 / 25280 / 25347 | 5222 / 5280 / 5347 |
+| API / policy / web | 23001 / 23002 / 23000 | 3001 / 3002 / 3000 |
+
+Project, network and volumes use `wacando-agent2`. All bindings use 127.0.0.1;
+host port 3000 remains reserved for Timon. Only inherited development secrets
+were used. Generated compose credentials remain outside evidence in a mode-0600
+temporary file and were removed after shutdown.
+
+**Retirement dependency:** the controllers create synthetic owners through
+`/api/auth/sign-up/email`, then use the existing v1 onboarding endpoints. The
+CLI checker imports `apps/web/src/lib/onboarding-prompts.ts`. This qualification
+depends on the web onboarding flow scheduled for retirement in Wacando #42; it
+does not qualify the future app/pairing flow. The web endpoint was checked by
+HTTP only, not by a browser onboarding session.
+
+### Setup commands and observed results
+
+From the main-service checkout:
+
+```sh
+git fetch origin main
+git worktree add --detach ../agent2-api origin/main
+```
+
+From the plugin checkout, the retained
+[fixture preparation script](evidence/issue-2/prepare-local-stack.py) reproduces
+the exact generated compose and seed adaptation (both SHA-256 hashes matched
+the initially generated files):
+
+```sh
+python3 docs/evidence/issue-2/prepare-local-stack.py /home/kyle/timon-projects/wacando/agent2-api
+timeout 120s docker compose -p wacando-agent2 -f /tmp/wacando-agent2.compose.json up -d postgres ejabberd
+timeout 180s bash /tmp/wacando-agent2-ci-up.sh
+```
+
+Exit 0. [Seed output](evidence/issue-2/local-seed.txt) confirms real ejabberd
+26.7.0, the six documented synthetic dev accounts and all three shifted ports.
+
+From the isolated main checkout, final successful image builds:
+
+```sh
+BUILDX_CONFIG=/tmp/wacando-agent2-buildx timeout 600s docker compose -p wacando-agent2 -f /tmp/wacando-agent2.compose.json build api
+BUILDX_CONFIG=/tmp/wacando-agent2-buildx timeout 600s docker compose -p wacando-agent2 -f /tmp/wacando-agent2.compose.json build policy
+BUILDX_CONFIG=/tmp/wacando-agent2-buildx timeout 600s docker compose -p wacando-agent2 -f /tmp/wacando-agent2.compose.json build web
+timeout 120s docker compose -p wacando-agent2 -f /tmp/wacando-agent2.compose.json up -d --no-deps --no-build api
+timeout 120s docker compose -p wacando-agent2 -f /tmp/wacando-agent2.compose.json up -d --no-build policy
+timeout 120s docker compose -p wacando-agent2 -f /tmp/wacando-agent2.compose.json up -d --no-build web
+```
+
+Exit 0 for the final builds and starts. Complete logs:
+[API](evidence/issue-2/local-build-api.txt),
+[policy](evidence/issue-2/local-build-policy.txt),
+[web](evidence/issue-2/local-build-web.txt),
+[full-stack start](evidence/issue-2/local-up.txt).
+API/contracts/XMPP and policy typechecks passed inside their images; the web's
+Next build and TypeScript check passed. All five services were healthy in the
+[status output](evidence/issue-2/local-status.txt).
+
+```sh
+curl -fsS --max-time 5 http://localhost:23001/health
+curl -fsS --max-time 5 http://localhost:23000/onboarding -o /dev/null -w 'Web onboarding HTTP %{http_code}\n'
+```
+
+Exit 0: `{"ok":true}` and `Web onboarding HTTP 200`.
+[Actual outputs](evidence/issue-2/local-health.txt).
+
+Setup failures were infrastructure/dependency failures, not successful acceptance:
+the default buildx cache was read-only; the first group build and first policy
+build failed with `frontend grpc server closed unexpectedly`
+([group](evidence/issue-2/local-build-first.txt),
+[policy](evidence/issue-2/local-build-policy-first.txt)). An exploratory legacy
+API build reached `corepack prepare` but hit its 180-second timeout; a bounded
+`docker pull node:24-alpine` then succeeded. The host briefly showed load 52.65
+and full I/O pressure averaging 62.33% over 60 seconds. Retrying serial builds
+with the writable buildx cache succeeded. No daemon or shared service was
+restarted. A separate source dependency preparation completed with:
+
+```sh
+COREPACK_HOME=/tmp/wacando-agent2-corepack timeout 600s pnpm install --frozen-lockfile --store-dir /tmp/wacando-agent2-pnpm-store
+```
+
+The first default Corepack attempt failed on its read-only home cache. The final
+install exited 0 with the frozen lockfile unchanged; API execution used the
+Docker image, not these host dependencies.
+
+### Actual API/runtime checks
+
+From the plugin checkout:
+
+```sh
+npm_config_cache=/tmp/wacando-issue2-npm-cache timeout 600s npm ci --include=dev
+WACANDO_LIVE_TEST_ORIGIN=http://localhost:23001 timeout 600s node --test tests/onboarding-live.test.mjs
+npm_config_cache=/tmp/wacando-issue2-npm-cache WACANDO_LIVE_TEST_ORIGIN=http://localhost:23001 timeout 600s npm run check
+npm_config_cache=/tmp/wacando-issue2-npm-cache timeout 600s npm run check:mcp
+node --check scripts/check-host-onboarding.mjs
+git diff --check
+```
+
+All exit 0 at that stage (`git diff --check` checked then-uncommitted changes,
+not the cumulative PR diff containing preserved raw logs). The initial checker
+could not import `esbuild`; `npm ci` without
+`--include=dev` inherited production dependency selection and did not install
+it. The explicit dev install added two packages and resolved that prerequisite.
+
+- [Standalone live suite](evidence/issue-2/local-live.txt): **3 passed, 0 failed,
+  0 skipped**, with the installed Codex/Cursor/Claude runtimes and real
+  API/Postgres/ejabberd/OMEMO. It exercises official verification, enrollment,
+  public-bundle publication, a fresh MCP process resuming with consumed token,
+  byte-stable private identity, owner remote revocation and explicit rejection.
+- [Full final check](evidence/issue-2/local-check.txt): **57 passed, 0 failed,
+  0 skipped**, including those three real integration cases and the existing
+  shutdown-lock regressions. Generated runtimes match shared sources. No
+  separate plugin lint/typecheck scripts exist.
+- [MCP Inspector](evidence/issue-2/local-check-mcp.txt): official Inspector 2.7.0
+  passes all three hosts. No MCP wire or generated-runtime change was needed in
+  this follow-up; the checker itself is a development controller.
+
+The direct runtime suite requires actual parsed `connected: true` and proves
+issue #2's agreed runtime acceptance: identity resume and owner revocation in
+all three profiles. It does not qualify any real CLI event stream or host UI;
+that separate qualification belongs to Wacando #17. It does not mock the XMPP
+contract or delete a lock.
+
+### Actual CLI attempts and residual sandbox limitation
+
+```sh
+WACANDO_CHECKOUT=/home/kyle/timon-projects/wacando/agent2-api WACANDO_LIVE_TEST_ORIGIN=http://localhost:23001 WACANDO_TEST_HOST=cursor timeout 600s node scripts/check-host-onboarding.mjs
+WACANDO_CHECKOUT=/home/kyle/timon-projects/wacando/agent2-api WACANDO_LIVE_TEST_ORIGIN=http://localhost:23001 WACANDO_TEST_HOST=codex timeout 600s node scripts/check-host-onboarding.mjs
+```
+
+Both exit 1, **before any confirmed MCP call**. Outputs:
+[Cursor](evidence/issue-2/local-cursor.txt),
+[Codex](evidence/issue-2/local-codex.txt). Each reports `Host exit=1`, `locks=none`,
+`calls=0`, with raw host output suppressed. No `verified: true` or
+`connected: true` host payload was obtained; host enrollment, resume and remote
+revocation stages were therefore not reached.
+
+The initial Cursor attempt failed at `mcp enable`: the runner exposes a
+read-only `/tmp/.git`, so Cursor resolved the ancestor as its project root and
+missed the fixture's `.cursor/mcp.json`. The checker now creates its own Git
+root, directs Cursor project data and compile cache into the fixture, and
+disables Cursor debug logs. This fixes configuration lookup without editing
+global host configuration or changing home/credential locations. The next
+attempt passed enable and reached the CLI, which exited before tool invocation.
+
+Minimal probes containing no onboarding secrets isolated the remaining errors:
+
+```sh
+git init --quiet /tmp/wacando-cursor-config-qGCIeU
+CURSOR_DATA_DIR=/tmp/wacando-cursor-config-qGCIeU/cursor-data NODE_COMPILE_CACHE=/tmp/wacando-cursor-config-qGCIeU/cursor-cache CURSOR_AGENT_DISABLE_DEBUG_LOG=1 timeout 180s cursor-agent --print --output-format stream-json --auto-review --trust --workspace /tmp/wacando-cursor-config-qGCIeU 'Do not use any tools. Return only ready.'
+timeout 180s codex exec --ephemeral --json --skip-git-repo-check --approve-for-me -C /tmp 'Do not use any tools. Return only ready.'
+timeout 180s codex exec --ephemeral --json --skip-git-repo-check --approve-for-me -c 'sqlite_home="/tmp/wacando-agent2-codex-sqlite"' -c 'log_dir="/tmp/wacando-agent2-codex-logs"' -C /tmp 'Do not use any tools. Return only ready.'
+```
+
+Each exits 1. Cursor's [actual diagnostic](evidence/issue-2/local-cursor-probe.txt):
+
+```text
+Error: EROFS: read-only file system, open '/home/kyle/.cursor/sandbox-policies/sandbox-policy-ab97f73e2a601171'
+```
+
+Codex's [initial](evidence/issue-2/local-codex-probe.txt) and
+[isolated SQLite/log](evidence/issue-2/local-codex-probe2.txt) diagnostics:
+
+```text
+Error: failed to initialize in-process app-server client: Read-only file system (os error 30)
+```
+
+The launched mission's filesystem policy permits writes only in the project
+and temporary roots; required host state locations are read-only. No policy
+was disabled, no permissions widened, no home variable changed and no host
+credentials copied or modified. Cursor/Codex CLI execution could not reach
+MCP in this sandbox. No actual Claude CLI onboarding attempt is recorded here;
+its passing runtime profile is not CLI evidence. All three CLIs remain
+**NOT QUALIFIED in this sandbox**, with follow-up in Wacando #17 rather than
+an additional acceptance blocker for issue #2. This documentary follow-up
+requests no sandbox, HOME or credential access and changes no host installation
+or configuration.
+
+### Cleanup and residual risks
+
+```sh
+timeout 120s docker compose -p wacando-agent2 -f /tmp/wacando-agent2.compose.json down -v
+docker compose -p wacando-agent2 -f /tmp/wacando-agent2.compose.json ps
+docker volume ls --filter label=com.docker.compose.project=wacando-agent2
+docker inspect wacando-issue10-postgres wacando-issue10-ejabberd --format '{{.Name}} status={{.State.Status}} started={{.State.StartedAt}} restarts={{.RestartCount}}'
+```
+
+Exit 0. [Complete cleanup output](evidence/issue-2/local-down.txt) confirms all
+five containers, the network and three named volumes removed, with no project
+containers/volumes remaining. Issue-10 services were still running with zero
+restarts and start times before this qualification. Synthetic identities,
+owner sessions and server-side metadata disappeared with the isolated volumes;
+fixture plugin state was cleaned normally. No lock was removed to manufacture
+a success or retry the same identity.
+
+- **HIGH, residual CLI qualification:** actual Cursor/Codex/Claude CLI
+  verification, identity resume after host restart, preserved keys and remote
+  revocation are **NOT QUALIFIED in this sandbox**. Cursor/Codex attempts failed
+  before MCP because of read-only host state; Claude CLI has no recorded attempt.
+  Host event-shape compatibility remains unproven. Wacando #17 owns this work;
+  the runtime PASS applies only to the agreed issue #2 acceptance scope.
+- **MEDIUM, residual:** SIGKILL, a short host termination deadline or the
+  45-second cleanup cap may leave stale locks. The fix does not recover crash
+  locks; existing locks stay preserved.
+- Cursor IDE/Desktop, Codex Desktop, Claude host UI, macOS/Windows, encrypted
+  conversation exchange, future pairing/app flow and production were not tested.
+
+Implementation and issue #2 runtime acceptance checks: **PASS** (three profiles,
+real Postgres/ejabberd/OMEMO; identity resume and revocation).
+Actual CLI qualification: **NOT QUALIFIED in this sandbox**, tracked in Wacando #17.
+Independent review: **PENDING**. [PR #9](https://github.com/lbframe/wacando-agent/pull/9)
+remains draft; issue #2 stays open until review/merge. No merge or publication.
+The [Wacando #42](https://github.com/lbframe/wacando/issues/42) retirement dependency
+remains: this evidence uses v1 web onboarding and its prompt builder, and does
+not qualify the replacement app/pairing flow.
+
+The [documentary follow-up evidence](evidence/issue-2/DOCUMENTARY_FOLLOWUP.md)
+records the scope decision and checks separately from the unchanged raw logs.
+
+## Manual CLI qualification after host restart
+
+**Procedure only, NOT EXECUTED by this documentary follow-up.** This is the
+reproducible follow-up for [Wacando #17](https://github.com/lbframe/wacando/issues/17),
+not additional evidence of a CLI PASS. Commands below are for an operator's
+terminal on an already configured, authenticated host. The previous assertion
+that all three CLIs' `--help` checks passed has no archived output and is
+withdrawn, including the Claude claim. This follow-up separately archives
+[Codex help](evidence/issue-2/codex-help.json),
+[Codex exec help](evidence/issue-2/codex-exec-help.json) and
+[Cursor help](evidence/issue-2/cursor-help.json), each exit 0; only their flags
+are checked. No `claude --help` was run by this follow-up; Claude flags remain
+unverified. Before using a launch command, verify its flags on that target
+host; unavailable or incompatible commands leave that CLI NOT QUALIFIED.
+Help success does not qualify MCP behavior.
+
+The [original reviewed procedure snapshot](https://github.com/lbframe/wacando-agent/blob/abd3e52a285808df5b4cc3e1f53621421ef9b316/docs/CURSOR_IDENTITY_RESUME.md#manual-cli-qualification-after-host-restart)
+is immutable and survives branch deletion. That snapshot predates the revocation
+wording correction below; use the corrected acceptance in this document.
+
+### Preconditions and baseline, separately for each CLI
+
+Use a designated test identity and an approved service with real Postgres,
+ejabberd and OMEMO. Record the service revision, plugin revision and CLI version.
+The installed package must include PR #9's cleanup fix. Its existing MCP
+configuration must use the exact same API origin and protected state directory
+before and after restart. Keep each host's own installation/agent and origin/host
+partition; do not transfer state between Cursor, Codex and Claude.
+`qualification_origin` must equal `new URL(configuredApiUrl).origin` exactly,
+including normalized scheme, hostname and port, with no trailing slash or path
+(for example, `http://localhost:23001`). The service stores state under the hash
+of `URL.origin + "\n" + host`; the fingerprint function hashes the supplied
+string literally. A trailing slash selects a different partition and fails
+closed (typically ENOENT); it is not an identity change or a PASS.
+
+The owner first completes the official installation/enrollment flow for that
+CLI: observe the actual MCP payloads `verified: true` and `connected: true`, plus
+owner-visible verification/connection. A host's prose, exit code, or outer
+`isError: false` is insufficient. This procedure starts with that already
+enrolled identity; it installs nothing and changes no host configuration.
+
+Replace the angle-bracket placeholders below with local paths and public IDs
+from that identity's metadata. They are not authentication credentials. Use the
+existing protected state directory; do not change HOME or read/copy any durable
+credential. Use a trusted existing workspace. For Cursor/Claude, the package
+paths are the existing installed plugin directories, not marketplace roots.
+
+```sh
+qualification_host='cursor' # Run separately with cursor, codex, then claude.
+qualification_workspace='<absolute existing trusted workspace>'
+qualification_origin='<exact URL.origin of configured API; no trailing slash>'
+qualification_agent_id='<public agent ID>'
+qualification_handle='<public @username/agent handle>'
+qualification_installation_id='<public installation ID>'
+qualification_state='<absolute existing protected state directory>'
+cursor_package='<absolute installed wacando-cursor directory>'
+claude_package='<absolute installed wacando-claude directory>'
+
+codex --version
+cursor-agent --version
+claude --version
+```
+
+The following local operator function reads only the selected OMEMO state and
+emits a SHA-256 fingerprint of `identityKeyPair`, never the private key material.
+The baseline remains local. Do not attach state files or raw CLI transcripts to
+issues. After normal closure of the initial enrolled host, check its processes
+have exited; the command also refuses a remaining lock. Do not delete a lock or
+regenerate keys to pass this procedure.
+
+```sh
+qualification_identity() {
+  node --input-type=module - "$qualification_state" "$qualification_origin" "$qualification_host" "$qualification_agent_id" <<'NODE'
+import { readFile, readdir } from 'node:fs/promises';
+import { createHash } from 'node:crypto';
+import { join } from 'node:path';
+const [root, origin, host, agentId] = process.argv.slice(2);
+const hash = value => createHash('sha256').update(value).digest('hex');
+const partition = join(root, hash(`${origin}\n${host}`));
+if ((await readdir(partition)).some(name => name.endsWith('.lock'))) {
+  throw new Error('Host cleanup left a lock; qualification failed. Preserve state.');
+}
+const state = JSON.parse(await readFile(join(partition, `omemo-${hash(agentId)}`, 'classic-state.json'), 'utf8'));
+if (!state.identityKeyPair) throw new Error('Missing identity; qualification failed.');
+console.log(hash(JSON.stringify(state.identityKeyPair)));
+NODE
+}
+qualification_evidence="$qualification_workspace/.wacando-qualification-$qualification_host"
+(umask 077; mkdir "$qualification_evidence")
+qualification_identity > "$qualification_evidence/identity-before.sha256"
+```
+
+Require exit 0 at every step; stop if baseline creation fails. Keep the baseline
+directory across any machine reboot. The fingerprint is for local comparison;
+record only the comparison result in shared evidence.
+
+### Start a fresh host and resume, per CLI
+
+Quit the initial CLI normally and wait for its MCP process to finish cleanup.
+Start a new CLI process, not a resumed chat. For a machine-reboot run, shut down
+normally, reboot through the host's usual controls, restore service availability,
+and repeat the variable/function definitions above with exactly the same values;
+keep the existing baseline directory and do not rerun `mkdir` or overwrite it.
+Record which restart was exercised (CLI process or machine). No reboot was
+performed in the sandbox evidence.
+
+Build the same public-ID-only prompt before each launch:
+
+```sh
+resume_prompt="Invoke the installed Wacando MCP tool wacando_enroll_agent exactly once with {\"apiBaseUrl\":\"$qualification_origin\",\"agentId\":\"$qualification_agent_id\",\"handle\":\"$qualification_handle\",\"installationId\":\"$qualification_installation_id\",\"enrollmentToken\":\"already-consumed\"}. Return its actual safe tool payload. Use no shell, HTTP or transport substitute. Do not inspect credentials or record this prompt. If the tool is unavailable or fails, report the failure and stop."
+```
+
+Run only the command for the selected host, with its normal MCP approvals:
+
+| CLI | Exact launch command | Required observation |
+| --- | --- | --- |
+| Cursor | `cursor-agent --workspace "$qualification_workspace" --plugin-dir "$cursor_package" "$resume_prompt"` | Actual `wacando_enroll_agent` tool payload has `connected: true` and the same handle; expand the tool result instead of trusting Cursor's outer success wrapper. |
+| Codex | `codex -C "$qualification_workspace" "$resume_prompt"` | The already activated Wacando MCP server returns `connected: true` and the same handle in the actual tool payload. |
+| Claude Code | From `cd "$qualification_workspace"`, run `claude --plugin-dir "$claude_package" "$resume_prompt"` | Actual Wacando tool payload has `connected: true` and the same handle. The automated Codex/Cursor event parser does not support Claude; inspect its actual MCP tool result manually. |
+
+Keep the host open long enough to observe the tool result and the owner-visible
+connection. `already-consumed` is a deliberately unusable placeholder: successful
+resume must use the saved durable identity without a fresh token, installation,
+agent or keypair. Then quit normally, wait for this host's MCP process to exit,
+and run:
+
+```sh
+qualification_identity > "$qualification_evidence/identity-after.sha256"
+cmp "$qualification_evidence/identity-before.sha256" "$qualification_evidence/identity-after.sha256"
+```
+
+Expected: both commands exit 0, `cmp` is silent, and no lock remains. Any missing
+payload, timeout, forced termination, changed fingerprint or remaining lock is
+FAIL for this CLI; preserve state and report the result without a retry that
+removes a lock. Runtime PASS cannot turn that CLI result into PASS.
+
+### Owner revocation and fresh-host rejection, per CLI
+
+Using the official owner UI, revoke this same designated test agent and confirm
+its revoked status. Start another fresh CLI with the same launch command and
+`resume_prompt`. For this already-saved identity, not yet marked revoked
+locally, `enroll()` skips token redemption and calls `open()`. The API's
+403/`AGENT_REVOKED` rejection of durable access is handled there. Expected exact
+MCP error text:
+
+```text
+Agent revoked or durable access rejected. Connection attempts have stopped. Check the identity on the site.
+```
+
+If background recovery has already persisted `revoked: true` before the call,
+`enroll()` instead rejects with:
+
+```text
+Agent revoked. Connection attempts have stopped. Create a new identity on the site.
+```
+
+The shorter `Agent revoked. Connection attempts have stopped.` belongs to
+initial token redemption when no agent is saved; it is not the expected path
+for this procedure. These paths are in `packages/onboarding/service.mjs`
+(`open()` catch, saved-revocation guard, and initial-enrollment catch).
+
+Require exactly one actual `wacando_enroll_agent` result with `isError: true`,
+rejection text matching the prefix `/^Agent revoked[. ]/`, and no
+`connected: true` in that result. This accepts the relevant variants, consistent
+with the live test's `/Agent revoked/` assertion and the stricter host parser's
+prefix check. Host prose, an outer success/error wrapper, a missing tool result,
+a generic error or a timeout cannot pass. The durable-access message also covers
+other 401/403 rejections: the message alone does not prove owner revocation.
+Require the earlier successful resume of the same identity and confirmed revoked
+status in the official owner UI as well. The host must remain responsive.
+
+Quit normally, then repeat the fingerprint comparison above: exit 0 and
+identical identity, with no leftover lock. Revocation is the final step; do not
+reuse that identity for a successful-resume scenario.
+
+For each CLI, record the version, revisions, restart type, safe MCP result,
+owner-visible status, normal shutdown, fingerprint equality, revocation result,
+commands, exit codes, untested points, residual risks and PASS/FAIL. Never retain
+temporary prompt tokens, cookies, credentials, private keys or message content.
+Cursor/Codex EROFS before MCP means **NOT QUALIFIED**, never PASS; an unattempted
+Claude CLI also stays **NOT QUALIFIED**. All three are currently **CLI not
+qualified in the sandbox**.
+
+**Wacando #42 dependency:** this v1 procedure's initial setup and historical
+checker depend on the web onboarding flow and `onboarding-prompts.ts`. When
+that flow is retired under [#42](https://github.com/lbframe/wacando/issues/42),
+adapt initial setup to the approved replacement app/pairing flow for #17. Do not claim that this v1 evidence proves the future flow.