@wacando/agent 0.0.0-stage → 2.0.0-rc.1

package/docs/PUBLIC_ONBOARDING_READINESS.md

@@ -0,0 +1,156 @@
+# Public onboarding readiness — September 23, 2026
+
+Local site/plugin interoperability is validated within the scope of the
+[integration record](OMEMO_PREKEY_INTEGRATION.md). The next gate is deployment
+of the onboarding API and web application, then the complete HTTPS/WSS journey.
+This is not approval to publish the npm package.
+
+## Production observations and deployment candidate
+
+Unauthenticated GET probes with redirects disabled, on September 23 at
+00:16 UTC, returned 404 from both:
+
+- `https://app.wacando.fr/v1/onboarding`
+- `https://api.wacando.fr/v1/onboarding`
+
+A credential-free WebSocket connection to `wss://xmpp.wacando.fr/ws` opened
+with negotiated subprotocol `xmpp`. TLS certificate verification was enabled.
+This proves only the public WebSocket upgrade, not SASL authentication, session
+grants, OMEMO or STOP in production. No production account was created.
+
+The source route requires a human session; after deployment, an unauthenticated
+GET should return the expected 401 rather than 404. A 401 alone is not acceptance:
+the authenticated owner response and actual plugin callbacks must also pass.
+
+The existing Wacando runbook is `../wacando/docs/deploy/wacando.md`; its workflow
+is `.github/workflows/wacando.yml`. It builds API, policy and web images from
+main, pins `IMAGE_TAG` to the commit SHA, and deploys via Coolify. At inspection,
+onboarding, its migration, web changes and OMEMO repairs were still uncommitted
+in the upstream checkout, mixed with other work. No release commit has been
+selected in this session. Redeploying the existing image cannot incorporate
+those working-tree changes. Select and review the actual release candidate
+before triggering the workflow; preserve unrelated changes.
+
+Required candidate contents and checks:
+
+1. Include the API routes, auth changes, schema and migration
+   `apps/api/drizzle/0001_lonely_starfox.sql`, journal/snapshot, and matching web
+   proxy/onboarding UI. Include the OMEMO fixes used by the local qualification.
+2. Run the upstream candidate's CI and migration checks using disposable test
+   infrastructure, then follow the existing runbook for backup, deployment and
+   rollback. The API entrypoint runs migrations: merely replacing the web image
+   does not deploy onboarding. Do not remove production tables for rollback.
+3. Preserve the provisioned database, secrets and routing. The production API
+   sets `XMPP_DOMAIN=wacando.fr`; the enrollment response currently defaults to
+   `wss://xmpp.wacando.fr/ws` for that domain. Verify the actual response after
+   deployment rather than assuming build-time web settings configure the API.
+4. `WACANDO_PLUGIN_INSTALL_COMMAND` is read by the API but is not currently
+   forwarded by the checked-in production Compose API environment. Before the
+   later npm launch, wire it into the deployment configuration and verify the
+   owner response contains the exact published, versioned command. Leave it
+   unset until a real package/version exists; do not invent availability.
+5. Record deployed image digests, migration result and route health, then execute
+   the HTTPS/WSS acceptance below. No production deployment was performed here.
+
+## HTTPS/WSS acceptance after deployment
+
+Use synthetic owners and the final installed plugin. Preserve existing host
+configuration and use the literal site-generated prompts. Record the host
+version and final bundle hash, without storing prompt tokens or credentials.
+
+- The real MCP verification tool makes the owner's installation green.
+- The second prompt binds the intended agent to the selected installation.
+- Enrollment returns the expected secure XMPP destination; the durable credential
+  obtains a grant, XMPP authentication and OMEMO publication succeed before the
+  connected callback. Follow no credential-bearing redirect.
+- The existing peer and plugin decrypt in both directions; both owners observe
+  both senders in their real browsers. Server scans find no plaintext canaries.
+- A host restart preserves identity/keys and resumes using the saved credential,
+  without consuming another temporary token. Heartbeat recovery and STOP pass.
+- Expiry, replay, wrong installation and revocation fail as specified, with no
+  durable credentials in MCP output or host logs. Revoke test agents afterward.
+
+The current live scripts deliberately restrict their target to loopback. Do not
+remove that restriction casually or claim their local pass covers production;
+prepare a scoped production fixture and explicit synthetic-account cleanup.
+
+## Host qualification
+
+The final bundle is identified by the hash in the integration record.
+`scripts/check-host-onboarding.mjs` exercises real Codex CLI with a separately
+installed copy and literal site prompts. See that record for the latest result.
+
+Codex CLI 0.153.4 passed verification, enrollment and fresh-host resume with
+the final bundle. Cursor Agent CLI `2026.08.25-3e8eec8` also passed all three
+steps with the actual copied Cursor plugin loaded via `--plugin-dir`. Both runs
+checked installation/connection callbacks and found no durable credential
+markers in host output. The fixtures revoked their synthetic agents afterward.
+
+```sh
+WACANDO_TEST_HOST=cursor \
+WACANDO_LIVE_TEST_ORIGIN=http://localhost:3005 \
+WACANDO_CHECKOUT=/home/kyle/work/wacando \
+  node scripts/check-host-onboarding.mjs
+```
+
+Cursor used `--auto-review`, with workspace trust limited to the newly created
+fixture directory; no `--force`, `--yolo`, sandbox disable or blanket MCP
+approval was used. An initial harness path error and then a workspace-trust
+refusal were corrected before the passing run. These were setup failures and
+did not validate the plugin. The tests do not exercise Cursor IDE installation
+UI or its built-in browser.
+
+Cursor Agent CLI is installed and authenticated, version `2026.08.25-3e8eec8`.
+The `cursor --version` error came from a PATH-searching shell shim; it did not
+prove Cursor was absent. The initial absence claim was incorrect.
+`claude` is not available in this shell's PATH; this does not prove absence
+elsewhere. Claude still needs both real tools, host reload and credential-based
+resume in an installed, authenticated host. Record its actual version and
+browser availability. Successful packaged-process tests alone do not qualify
+an actual host. Existing global host configuration was preserved.
+
+## Consumed-prekey recovery: definition for implementation review
+
+Current behavior remains fail-closed. No automatic repair is implemented and
+no previously deleted private prekey can be reconstructed. The following is a
+proposed bounded recovery design for the shared Wacando OMEMO components, not
+a plugin transport replacement or an already accepted protocol change:
+
+1. Distinguish a missing consumed prekey from authentication failure or an
+   untrusted identity. Persist neither plaintext nor secrets in diagnostics.
+2. Keep the receiver's identity and all healthy sender/device ratchets. Publish
+   the remaining/replenished public bundle with monotonically increasing IDs;
+   never restore deleted one-time private keys or reuse their IDs.
+3. For the affected sender/device pair, obtain a fresh authenticated bundle and
+   establish a new session only through the existing provider's supported
+   handshake. Specify an authenticated recovery signal and duplicate handling
+   before implementation; do not infer successful delivery from publication.
+4. Bound automatic attempts per peer/device and back off. Do not silently reset
+   trust or retry old ciphertext as if it belonged to the new session. Message
+   resend needs a defined duplicate/delivery policy; require an explicit user
+   resend when delivery is uncertain. Never replay old transcript content
+   automatically into a new conversation.
+5. Prove forced stale-bundle collisions, two devices under one sender, concurrent
+   senders, restarts during recovery, replay, ratchet preservation and STOP with
+   real crypto. STOP/revocation must cancel recovery, and a closed conversation
+   must never reopen. No plaintext fallback is permitted.
+
+Until that design is implemented and independently reviewed upstream, surface
+the failure and preserve local state. A new onboarding token cannot repair an
+OMEMO session. Do not prescribe deleting local state or recreating an agent as
+a proven fix. This differs from the documented lost-enrollment-response case,
+whose current API recovery requires revoking the identity and using a new handle.
+
+## Unexplained timeouts remain open
+
+The first integration run had five deadline failures; the unchanged rerun passed.
+The [integration record](OMEMO_PREKEY_INTEGRATION.md) retains their exact counts
+and scope. The MCP helper's default deadline was 3 seconds and relocated-package
+tests had a 10-second deadline. No per-request startup/queue/event-loop timing
+was captured in the failed run, so contention is only a hypothesis.
+
+On recurrence, capture redacted request IDs/methods, startup/initialization
+latencies, child exit status, event-loop delay and concurrent workload timings.
+Compare isolated and overlapping runs with identical code and deadlines. Do not
+raise timeouts or mark the incident resolved solely because a retry passes.
+The earlier transient enrollment connection failure remains a separate incident.

package/docs/RELEASE.md

@@ -0,0 +1,25 @@
+# Releasing `@wacando/agent`
+
+The runtime is published **publicly** on registry.npmjs.org as
+`@wacando/agent` (bin `wacando-agent`) by `.github/workflows/release.yml`,
+with the repository secret `NPM_TOKEN` (granular automation token with
+read/write on the `wacando` npm org). The repository stays private.
+
+1. Bump the version in `package.json`, `packages/onboarding/version.mjs` and the
+   three plugin manifests (`npm test` checks they agree), merge to `main`.
+2. `git tag v<version> origin/main && git push origin v<version>`.
+
+The workflow (self-hosted `lbframe-ci`, pinned Node 24 builder image) checks the
+tag equals the package version (stable tags must be on `main`; prereleases
+`-rc.N` may point at a PR head and get the `next` dist-tag), runs `npm ci` and
+`npm run check`, packs, dry-runs, publishes with `--access public`, then in a
+clean `node:22` container installs `@wacando/agent@<version>` globally from the
+registry, anonymously, and runs `wacando-agent --version` / `--help`.
+
+- No `--provenance`: npm refuses provenance for private source repositories and
+  on self-hosted runners.
+- No Actions artifacts are uploaded (the organization's storage quota is shared).
+- Licence: `UNLICENSED` (proprietary; no open-source licence has been decided).
+  The README states the terms; dependencies keep their own licences
+  (`THIRD-PARTY-NOTICES.txt`).
+- A version can never be republished: bump instead.

package/docs/WACANDO_PACKAGES.md

@@ -0,0 +1,26 @@
+# Wacando packages (public npm)
+
+The runtime depends on the shared Wacando packages built from the private
+`lbframe/wacando` repository and published **publicly on registry.npmjs.org**
+by its `packages.yml` workflow (lbframe/wacando `docs/PACKAGES.md`):
+
+| Package | Used for |
+|---|---|
+| `@wacando/contracts` | product types, handles, JID mapping |
+| `@wacando/xmpp` | presence echo (`announceAvailable`), MUC, MAM, PEP, origin checks, policy deliveries |
+| `@wacando/omemo` | native OMEMO on the official `@signalapp/libsignal-client`; `./wire` policy submission/digest helpers |
+
+- `package.json` pins exact versions; `package-lock.json` pins each archive's
+  SHA-512 from `registry.npmjs.org`.
+- `scripts/check-deps.mjs` (first step of `npm run check`) fails unless the
+  three packages resolve from the public registry at the pinned versions, with
+  no nested copy, the official libsignal present and no `@privacyresearch/*`
+  (classic GPL backend) anywhere in the graph.
+- No Wacando source is copied into this repository. The temporary `deps/`
+  archives used while GitHub Packages was billing-blocked are gone.
+
+Updating: `npm install --save-exact @wacando/contracts@<v> @wacando/xmpp@<v> @wacando/omemo@<v> && npm run notices && npm run check`.
+
+`@signalapp/libsignal-client` ships native prebuilds for macOS x64/arm64,
+Windows x64/arm64 and Linux x64/arm64 inside its npm package; no compiler is
+needed (`node-gyp-build` picks the prebuild for the running platform).

package/docs/evidence/issue-2/DOCUMENTARY_FOLLOWUP.md

@@ -0,0 +1,107 @@
+# Issue #2 documentary follow-up — October 15, 2026
+
+Initial local and PR #9 HEAD: `24ace6ef95d4a4f595dd712b325a1fc7cbbba449`.
+Branch: `fix/cursor-identity-resume`. Repository: `lbframe/wacando-agent`
+(private; the local directory/remote retain the historical `wacando-plugin` name).
+PR #9 was OPEN/draft; plugin issue #2 and Wacando #17 were OPEN.
+
+King's explicit decision relayed in mission
+`1dc1a826-eefb-4610-bdfa-5027f88ab4d0`: issue #2 acceptance covers identity
+resume and revocation through all three runtime profiles on real
+Postgres/ejabberd/OMEMO. Actual Cursor/Codex/Claude CLI qualification is deferred
+to [Wacando #17](https://github.com/lbframe/wacando/issues/17).
+Independent review is pending. This is an acceptance-scope correction, not a
+new implementation or a change to recorded outcomes.
+
+| Evidence | Observed outcome | Acceptance scope |
+| --- | --- | --- |
+| [Original live runtime suite](local-live.txt) | 3 passed, 0 failed, 0 skipped: codex, cursor, claude runtime profiles | PASS for issue #2 runtime resume/revocation; no actual CLI claim |
+| [Original full live check](local-check.txt) | 57 passed, 0 failed, 0 skipped | Existing regression and runtime acceptance evidence |
+| [Cursor checker](local-cursor.txt), [probe](local-cursor-probe.txt) | Exit 1 before confirmed MCP; EROFS writing host sandbox-policy state | Cursor CLI NOT QUALIFIED in the sandbox; never PASS |
+| [Codex checker](local-codex.txt), [initial probe](local-codex-probe.txt), [second probe](local-codex-probe2.txt) | Exit 1 before confirmed MCP; read-only filesystem initializing app-server | Codex CLI NOT QUALIFIED in the sandbox; never PASS |
+| Actual Claude CLI | No onboarding/resume attempt recorded in this evidence | Claude CLI NOT QUALIFIED in the sandbox; runtime PASS is separate |
+| [Documentary follow-up check](documentary-check.txt) | Exit 0; 54 passed, 0 failed, 3 skipped | Current build/generated-runtime/regression check; live stack not restarted |
+
+All previously committed raw outputs remain byte-for-byte unchanged. The
+[manual procedure](../../CURSOR_IDENTITY_RESUME.md#manual-cli-qualification-after-host-restart)
+provides exact per-CLI launch commands, a consumed-token placeholder, private
+local fingerprint comparison, normal shutdown and fresh-host revocation
+rejection. It was not executed here. The prior CLI `--help` success assertion
+is withdrawn below; no CLI or MCP qualification follows from help output.
+
+## Commands and results for this follow-up
+
+From the plugin checkout:
+
+```sh
+git branch --show-current
+git rev-parse HEAD
+git ls-remote origin refs/heads/fix/cursor-identity-resume
+gh pr view 9 --repo lbframe/wacando-agent --json title,body,headRefName,headRefOid,isDraft,state,url
+gh issue view 2 --repo lbframe/wacando-agent --json title,body,state,url
+gh issue view 17 --repo lbframe/wacando --json title,body,state,url
+gh issue view 42 --repo lbframe/wacando --json title,body,state,url
+```
+
+Exit 0. Local branch `fix/cursor-identity-resume`, local/remote/PR initial HEAD
+`24ace6ef95d4a4f595dd712b325a1fc7cbbba449`, draft/open PR and open issues
+confirmed. Initial bodies incorrectly treated CLI qualification as an issue #2
+acceptance blocker. Wacando #17's existing blockers are agent #3/#4 and service
+#12/#16/#40/#37; #42's existing blockers are #40/#37. Plugin #2 has no recorded
+blocked-by dependency. These dependency edges are preserved.
+
+```sh
+timeout 20s codex --help
+timeout 20s codex exec --help
+timeout 20s cursor-agent --help
+```
+
+Historical claims only; these are not archived execution evidence.
+Correction after independent review: no raw outputs for these commands were
+archived. The previous blanket exit-0/flag-verification claim is unsupported
+and withdrawn, including for Claude; this evidence does not establish that
+`claude` was available. The previously quoted Codex warning also has no archived
+help transcript here. Check flags on each target host before executing the
+manual procedure. That earlier follow-up claimed no supported help verification.
+The later [completion record](QUALIFICATION_LINK_FOLLOWUP.md) archives new safe
+Cursor/Codex help outputs only; no `claude --help` run or CLI qualification is claimed.
+
+```sh
+env -u WACANDO_LIVE_TEST_ORIGIN npm_config_cache=/tmp/wacando-issue2-npm-cache timeout 600s npm run check
+```
+
+Exit 0; [complete output](documentary-check.txt). Build and all three exact
+runtime checks pass. Tests: 57 total, 54 pass, 0 fail, 3 live cases skipped.
+No independent lint/typecheck script exists. The existing live PASS is retained;
+this run made no API request and did not recreate the retired ephemeral stack.
+
+[Document checks](documentary-validation.txt) record link targets, shell/Node
+syntax, unchanged prior evidence and the docs-only diff. The revocation wording
+claim in that record was too broad: it checked a message from the wrong path
+for an already-saved identity, and is corrected by the
+[review follow-up](REVIEW_FOLLOWUP.md).
+
+The successful `git diff --check` claim applies to the documentary follow-up
+`24ace6ef95d4a4f595dd712b325a1fc7cbbba449..abd3e52a285808df5b4cc3e1f53621421ef9b316`,
+not the cumulative PR diff `origin/main...HEAD`. That cumulative diff contains
+trailing whitespace in preserved raw evidence logs and exits 2; the logs must
+remain byte-for-byte unchanged.
+The final PR/issue bodies preserve the scope split, draft/open state, and #42
+retirement dependency. The worker supplies checks and evidence; independent
+review is a separate next step, not performed here.
+
+## Residual limits
+
+Actual CLIs are NOT QUALIFIED in the sandbox. Their current EROFS results are
+not successful enrollment/resume, and no new CLI onboarding/reboot/revocation
+run is claimed. Crash locks, the 45-second cleanup cap, host UIs, macOS/Windows,
+encrypted conversation exchange, replacement app/pairing flow and production
+remain outside this follow-up's validation. No lock was removed, no credentials
+were requested or copied, and no host installation/configuration was changed.
+No merge or publication occurred.
+
+The [Wacando #42](https://github.com/lbframe/wacando/issues/42) retirement
+dependency remains: v1 web onboarding and its prompt builder support the current
+fixture/procedure. Coordinate #17 with that retirement: once the web flow is removed, initial
+setup must use the approved replacement app/pairing flow. This evidence does
+not qualify the replacement or add a dependency edge to #42.

package/docs/evidence/issue-2/QUALIFICATION_LINK_FOLLOWUP.md

@@ -0,0 +1,105 @@
+# Qualification-link completion — October 15, 2026
+
+Task `58463914-cf55-4d12-8f7b-f736dd97e3f0`, PR #9, branch
+`fix/cursor-identity-resume`. The requested starting HEAD was
+`abd3e52a285808df5b4cc3e1f53621421ef9b316`. A concurrent task left local commit
+`24159b9c1724c8a2ae9b59386ea7e7c1e32bc147` with the saved-identity wording
+correction and checks, then stopped. This completion retains that documentation
+and adds immutable links and the authorized PR/issue body corrections.
+Independent follow-up review and merge remain pending; no runtime edit,
+publication, merge or issue close is part of this work.
+
+## Corrected acceptance
+
+The [review correction](REVIEW_FOLLOWUP.md) traces `enroll()` with saved state
+to `open()`, whose line 189 returns:
+
+```text
+Agent revoked or durable access rejected. Connection attempts have stopped. Check the identity on the site.
+```
+
+After that rejection has persisted local revocation, line 72 instead returns:
+
+```text
+Agent revoked. Connection attempts have stopped. Create a new identity on the site.
+```
+
+Line 81's shorter message belongs to first enrollment, not the saved-identity
+scenario. The live test asserts `/Agent revoked/`; the procedure requires an
+actual error result matching `/^Agent revoked[. ]/`, without affirmative
+connection, after prior successful resume and confirmed owner revocation of the
+same identity. It also requires responsive host, normal cleanup and identical
+private-identity fingerprint. The message alone covers other access denials
+and cannot prove owner revocation. This is source tracing, not a manual test.
+`qualification_origin` must be exactly `URL.origin`, including scheme, host and
+optional port, without trailing slash/path; the literal partition hash otherwise
+differs and the helper fails closed.
+
+## Durable references and GitHub bodies
+
+The procedure document, PR #9 body, plugin #2 body and Wacando #17 checklist
+use the immutable original reviewed snapshot at
+`abd3e52a285808df5b4cc3e1f53621421ef9b316` instead of branch links. That snapshot
+predates the wording correction: the current document and updated bodies state
+the corrected acceptance explicitly. It is not a newly executed qualification.
+
+The first three #2 boxes describe proven runtime acceptance and are checked;
+independent follow-up review/merge stays unchecked, with #2 OPEN/in progress and
+PR #9 OPEN/draft. All #17 qualification boxes remain unchecked. The #17 blocker
+line and native dependencies are preserved exactly; #42 remains a retirement
+coordination dependency with its existing blockers #40/#37. No dependency edge
+is added or removed. API read-back results are recorded in
+[body verification](qualification-body-validation.txt).
+
+## Commands and real results
+
+Safe help only, no prompt or MCP invocation:
+
+```sh
+timeout 20s codex --help
+timeout 20s codex exec --help
+timeout 20s cursor-agent --help
+```
+
+Each exited 0. Complete combined stdout/stderr is stored losslessly as the
+`combined_output` JSON string in [Codex](codex-help.json),
+[Codex exec](codex-exec-help.json), and [Cursor](cursor-help.json). Decode that
+string for exact bytes, including padded blank lines. Codex emits its read-only
+PATH-alias warning. Cursor's `--workspace`/`--plugin-dir` and Codex's `-C`/prompt
+syntax are present. These are new help runs, not proof of the prior unarchived
+claims or of CLI qualification. No `claude --help` was run; its flags remain
+unverified. Claude's absence from the reviewer's PATH is not contradicted by
+availability in another runtime.
+
+```sh
+env -u WACANDO_LIVE_TEST_ORIGIN npm_config_cache=/tmp/wacando-issue2-npm-cache timeout 600s npm run check
+```
+
+Exit 0, [complete output](qualification-link-check.txt): 57 tests, **54 passed,
+0 failed, 3 live cases skipped**, with build/generated equality passing. No
+separate lint/typecheck scripts exist. No new MCP/packaging implementation
+change justifies another Inspector run.
+
+[Document validation](qualification-link-validation.txt) records actual local
+link/anchor checks, shell/Node syntax checks without executing the procedure,
+raw evidence byte equality, docs-only scope and whitespace results. The
+historical `git diff --check 24ace6e..abd3e52` passes only that delta. The current
+follow-up `git diff --check abd3e52` passes separately. The cumulative PR diff
+`git diff --check origin/main` still exits 2 for preserved raw evidence logs;
+those logs remain byte-identical. No full-PR whitespace PASS is claimed.
+
+## Remaining untested items
+
+The manual restart procedure is **NOT EXECUTED**. Actual Cursor/Codex/Claude CLI
+verification, host restart/reboot, identity resume, event-shape compatibility and
+owner revocation remain **NOT QUALIFIED in this sandbox**, deferred to
+[Wacando #17](https://github.com/lbframe/wacando/issues/17). Prior Cursor/Codex
+EROFS failures remain failures, and Claude onboarding has no recorded attempt.
+Existing real API/Postgres/ejabberd/OMEMO runtime acceptance is retained; no live
+stack/API/CLI procedure was rerun. Crash locks, SIGKILL/short host deadlines,
+the 45-second cleanup cap, host UIs, macOS/Windows, encrypted conversation
+exchange, replacement app/pairing flow and production remain untested.
+[#42](https://github.com/lbframe/wacando/issues/42) still requires coordinating
+retirement of v1 web onboarding/prompt building with #17's initial setup.
+No host configuration or installation was changed, credentials accessed, lock
+removed, permission widened, package published, merge performed or issue closed.

package/docs/evidence/issue-2/REVIEW_FOLLOWUP.md

@@ -0,0 +1,93 @@
+# PR #9 review corrections — October 15, 2026
+
+Starting HEAD: `abd3e52a285808df5b4cc3e1f53621421ef9b316`, existing branch
+`fix/cursor-identity-resume`. Local documentation correction only, prepared for
+independent review of [PR #9](https://github.com/lbframe/wacando-agent/pull/9).
+At local commit `24159b9`, no push, publication, GitHub comment/review/body edit,
+merge or issue closure had occurred. That earlier task left acceptance boxes and
+branch-based external evidence links unchanged. The subsequent
+[completion record](QUALIFICATION_LINK_FOLLOWUP.md) records the broader authorized
+follow-up: immutable links and bodies, with proven runtime boxes checked and
+review/merge still pending. This note preserves the earlier check scope.
+
+## MEDIUM-1: follow the saved-identity path
+
+The manual procedure first proves resume with the same saved identity and an
+unusable token. `enroll()` reads that identity, skips initial token redemption,
+and calls `open()` (`packages/onboarding/service.mjs:72–99`). In a fresh host,
+`open()` requests `/v1/xmpp/session`; HTTP 403/`AGENT_REVOKED` becomes `ApiError`
+in `network.mjs:39`. Its catch stops retries, persists `revoked: true` and throws
+at `service.mjs:189`:
+
+```text
+Agent revoked or durable access rejected. Connection attempts have stopped. Check the identity on the site.
+```
+
+If background recovery has already persisted revocation, the guard at line 72
+instead throws:
+
+```text
+Agent revoked. Connection attempts have stopped. Create a new identity on the site.
+```
+
+Line 81's shorter message belongs to initial enrollment without saved agent
+state. It was the wrong expected output for this scenario. The revised procedure
+requires an actual MCP tool error (`packages/mcp/server.mjs:98`), the anchored
+`/^Agent revoked[. ]/` prefix (`scripts/host-result.mjs:20`), and no affirmative
+connection. The live test uses `/Agent revoked/` (`tests/onboarding-live.test.mjs:71`);
+it is existing runtime evidence, not a newly executed CLI qualification.
+
+An error string alone cannot establish owner revocation: `open()` also rejects
+other HTTP 401/403 access denials. The procedure additionally requires confirmed
+owner-UI revocation of the same previously resumed identity, exactly one actual
+tool result, a responsive host, unchanged private-identity fingerprint and normal
+lock cleanup. Missing results, generic failures, timeouts and host prose cannot
+pass. No implementation or generated file was changed.
+
+## LOW corrections and evidence scope
+
+- `qualification_origin` must exactly equal `new URL(configuredApiUrl).origin`.
+  `enroll()` and `CredentialStore.directory()` partition on that normalized
+  origin; the manual fingerprint function hashes the supplied string literally.
+  A trailing slash or other normalization difference selects the wrong directory
+  and fails closed. The procedure now gives the exact requirement and an example.
+- The earlier `--help` exit-0 assertion has no archived outputs. It is withdrawn
+  in both authored documents, including the Claude claim. No new help run is
+  claimed. Launch flags must be checked on the target host; this correction
+  establishes neither Claude availability nor CLI qualification.
+- The historical documentary whitespace check covers `24ace6e..abd3e52`, not
+  the cumulative PR. That historical range and the present follow-up pass.
+  `origin/main...abd3e52` exits 2 for whitespace in preserved raw evidence logs.
+  Those bytes are intentionally retained; the cumulative result is a residual
+  evidence-format limitation, not a new implementation failure.
+- The previous validation record's wording check was incorrect for the scenario;
+  its claim is explicitly corrected, rather than reused as proof.
+
+## Commands and actual results
+
+Required repository check, run in the foreground with a ten-minute bound:
+
+```sh
+env -u WACANDO_LIVE_TEST_ORIGIN npm_config_cache=/tmp/wacando-issue2-npm-cache timeout 600s npm run check
+```
+
+Exit 0. [Complete raw output](review-check.txt): build and all three exact
+runtime checks pass; 57 tests, 54 pass, 0 fail, 3 live cases skipped. No separate
+lint/typecheck scripts exist. The build reproduced the committed generated
+files without changing them. No MCP/packaging implementation change was made,
+so `check:mcp` was not rerun.
+
+[Documentary validation](review-validation.txt) contains actual source-path,
+local-link, shell/Node syntax, evidence-byte and whitespace check results,
+including the full cumulative whitespace diagnostics. Syntax checking did not
+execute the operator's procedure. All 22 files present at `24ace6e`, plus the
+prior documentary check log, are byte-for-byte preserved.
+
+Actual Cursor/Codex/Claude CLI enrollment, restart/reboot, resume and revocation
+remain NOT QUALIFIED in this sandbox; prior EROFS limitations remain. No live
+API/XMPP stack was restarted for this correction. Existing runtime acceptance
+evidence is unchanged. Independent review of this local correction is pending.
+[Wacando #17](https://github.com/lbframe/wacando/issues/17) owns CLI qualification;
+[Wacando #42](https://github.com/lbframe/wacando/issues/42) still owns retirement
+of the v1 web onboarding/prompt-builder dependency. Future app/pairing flow,
+crash locks, host UIs, other platforms and production remain untested.

package/docs/evidence/issue-2/baseline.txt

@@ -0,0 +1,76 @@
+TAP version 13
+# Subtest: cursor shutdown waits for session cleanup and releases its own lock without changing keys
+not ok 1 - cursor shutdown waits for session cleanup and releases its own lock without changing keys
+  ---
+  duration_ms: 1658.574925
+  type: 'test'
+  location: '/tmp/wacando-issue2-before.56NFHw/tests/onboarding-shutdown.test.mjs:16:3'
+  failureType: 'testCodeFailure'
+  error: |-
+    MCP must finish protected session cleanup before forcing exit
+    
+    0 !== null
+    
+  code: 'ERR_ASSERTION'
+  name: 'AssertionError'
+  expected: ~
+  actual: 0
+  operator: 'strictEqual'
+  stack: |-
+    TestContext.<anonymous> (file:///tmp/wacando-issue2-before.56NFHw/tests/onboarding-shutdown.test.mjs:57:12)
+    async Test.run (node:internal/test_runner/test:1054:7)
+    async startSubtestAfterBootstrap (node:internal/test_runner/harness:296:3)
+  ...
+# Subtest: codex shutdown waits for session cleanup and releases its own lock without changing keys
+not ok 2 - codex shutdown waits for session cleanup and releases its own lock without changing keys
+  ---
+  duration_ms: 1553.895394
+  type: 'test'
+  location: '/tmp/wacando-issue2-before.56NFHw/tests/onboarding-shutdown.test.mjs:16:3'
+  failureType: 'testCodeFailure'
+  error: |-
+    MCP must finish protected session cleanup before forcing exit
+    
+    0 !== null
+    
+  code: 'ERR_ASSERTION'
+  name: 'AssertionError'
+  expected: ~
+  actual: 0
+  operator: 'strictEqual'
+  stack: |-
+    TestContext.<anonymous> (file:///tmp/wacando-issue2-before.56NFHw/tests/onboarding-shutdown.test.mjs:57:12)
+    async Test.run (node:internal/test_runner/test:1054:7)
+    async Test.processPendingSubtests (node:internal/test_runner/test:744:7)
+  ...
+# Subtest: MCP shutdown finishes saving an in-flight verification response before exiting
+not ok 3 - MCP shutdown finishes saving an in-flight verification response before exiting
+  ---
+  duration_ms: 1261.625698
+  type: 'test'
+  location: '/tmp/wacando-issue2-before.56NFHw/tests/onboarding-shutdown.test.mjs:68:1'
+  failureType: 'testCodeFailure'
+  error: |-
+    The active verification still needs to save its response
+    
+    0 !== null
+    
+  code: 'ERR_ASSERTION'
+  name: 'AssertionError'
+  expected: ~
+  actual: 0
+  operator: 'strictEqual'
+  stack: |-
+    TestContext.<anonymous> (file:///tmp/wacando-issue2-before.56NFHw/tests/onboarding-shutdown.test.mjs:90:10)
+    async Test.run (node:internal/test_runner/test:1054:7)
+    async Test.processPendingSubtests (node:internal/test_runner/test:744:7)
+  ...
+1..3
+# tests 3
+# suites 0
+# pass 0
+# fail 3
+# cancelled 0
+# skipped 0
+# todo 0
+# duration_ms 4531.867881

package/docs/evidence/issue-2/check-mcp.txt

@@ -0,0 +1,14 @@
+
+> wacando-plugins@1.0.0 check:mcp
+> npm run build && node scripts/check-mcp.mjs
+
+
+> wacando-plugins@1.0.0 build
+> node scripts/build.mjs
+
+Built self-contained codex plugin: wacando@1.0.0
+Built self-contained cursor plugin: wacando-cursor@1.0.0
+Built self-contained claude plugin: wacando-claude@1.0.0
+Official Inspector 2.7.0 passed: wacando
+Official Inspector 2.7.0 passed: wacando-cursor
+Official Inspector 2.7.0 passed: wacando-claude