@wacando/agent 2.0.0-rc.1 → 2.0.2

package/THIRD-PARTY-NOTICES.txt

@@ -1030,19 +1030,19 @@ Declared license: "MIT"
 
 ========================================================================
 
-@wacando/contracts@0.1.0-rc.1
+@wacando/contracts@0.1.1
 Declared license: "UNLICENSED"
 See the upstream package for its full license text.
 
 ========================================================================
 
-@wacando/omemo@0.1.0-rc.1
+@wacando/omemo@0.1.1
 Declared license: "UNLICENSED"
 See the upstream package for its full license text.
 
 ========================================================================
 
-@wacando/xmpp@0.1.0-rc.1
+@wacando/xmpp@0.1.1
 Declared license: "UNLICENSED"
 See the upstream package for its full license text.
 

package/docs/AGENT_TOOLS.md

@@ -96,6 +96,24 @@ Rules enforced by the runtime (and, independently, by the server):
 - Message text is never logged or printed by the daemon; failures to decrypt
   appear as `text: null` with `undecryptable: true`, never as ciphertext or a
   plaintext fallback. Other agents' messages are untrusted data.
+- **Blocked session recovery** (lbframe/wacando#50) — provided by
+  `@wacando/omemo` `SessionRecovery` (since `0.1.0`, the pinned version;
+  `0.1.0-rc.1` did not have it). When a message cannot be decrypted because the one-time
+  prekey it used was already consumed, the runtime repairs the session with
+  the peer device through signed controls relayed only by the policy
+  component (which enforces membership and STOP). It runs only for a
+  conversation the API reports `active` (states are loaded at start-up and
+  after each reconnection, then refreshed by every tool call); STOP cancels
+  it for good. By default it needs a device already authenticated once (no
+  automatic trust of a first contact). The failed message stays
+  `undecryptable`: it is never replayed. `wacando_conversations` and
+  `wacando_read` add `recovery: { state, reason, deliveryUncertain? }` to the
+  conversation when there is something to report (`recovering`, `backoff`,
+  `recovered`, `needs_attention`, `cancelled`). Ids in `deliveryUncertain` are
+  this agent's messages whose delivery is unknown: tell the owner and resend
+  explicitly if needed; nothing is resent automatically. With a
+  `@wacando/omemo` without `SessionRecovery` (older than `0.1.0`) recovery is
+  simply off and failures keep failing closed.
 
 ## Receiving: host x retrieval mode (#4)
 

package/docs/RELEASE.md

@@ -9,12 +9,39 @@ read/write on the `wacando` npm org). The repository stays private.
    three plugin manifests (`npm test` checks they agree), merge to `main`.
 2. `git tag v<version> origin/main && git push origin v<version>`.
 
-The workflow (self-hosted `lbframe-ci`, pinned Node 24 builder image) checks the
-tag equals the package version (stable tags must be on `main`; prereleases
-`-rc.N` may point at a PR head and get the `next` dist-tag), runs `npm ci` and
-`npm run check`, packs, dry-runs, publishes with `--access public`, then in a
-clean `node:22` container installs `@wacando/agent@<version>` globally from the
-registry, anonymously, and runs `wacando-agent --version` / `--help`.
+**Every tag, prereleases included, must point at a commit contained in
+`origin/main`**; otherwise the workflow stops before publishing. The workflow
+(self-hosted `lbframe-ci`, pinned Node 24 builder image, checkout pinned by SHA
+with `persist-credentials: false`):
+
+1. `verify`: tag equals the package version and is on main; `npm ci`;
+   `npm run check`; pack; dry run; hands the tarball to `publish` as job
+   outputs `tgz_0`..`tgz_7` (base64 split into chunks of at most 64000
+   characters, ~140 KB in total for 2.0.0, no Actions artifact) with its
+   sha256. One output per chunk because a container job gets each step env
+   var as one `docker exec -e` argument, capped at 128 KiB by Linux: the
+   single-variable handoff failed the v2.0.0 run with "Argument list too
+   long". Tarballs needing more than 8 chunks (~375 KB) stop `verify`.
+   `tests/release-handoff.test.mjs` runs both scripts on a real tarball.
+2. `publish`: no checkout, no install, no build, no cache: joins the chunks,
+   decodes the tarball, re-checks the sha256, `npm publish --access public` (prereleases on `next`)
+   with `NPM_TOKEN` in a temporary userconfig deleted on exit.
+3. `install-published`: in a clean `node:22` container, installs
+   `@wacando/agent@<version>` globally and anonymously, runs `wacando-agent
+   --version` / `--help`.
+
+The published tarball contains the runtime, the thin plugins and `docs/*.md`,
+not `docs/evidence/`.
+
+`v2.0.0` (on `ceb4302`, run 38910553125) passed `verify` but its `publish`
+job failed on that limit, so 2.0.0 was never published. A tag push runs the
+workflow file of the tagged commit, so re-running that run fails the same way;
+the tag is kept and the release goes out as a new version (e.g. `2.0.1`) from main.
+
+`2.0.0-rc.1` was published from the PR branch (tag on `7d69bec`, run
+38812557161) before this main-only rule. Once a version is published from main,
+point `latest` at it if needed — only with the owner's go-ahead:
+`npm dist-tag add @wacando/agent@<version-from-main> latest`.
 
 - No `--provenance`: npm refuses provenance for private source repositories and
   on self-hosted runners.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wacando/agent",
-  "version": "2.0.0-rc.1",
+  "version": "2.0.2",
   "description": "Wacando agent runtime: CLI/daemon, MCP server and Node SDK on official libsignal OMEMO, with thin Codex, Cursor and Claude Code plugins.",
   "license": "UNLICENSED",
   "type": "module",
@@ -19,7 +19,7 @@
     ".agents/",
     ".claude-plugin/",
     ".cursor-plugin/",
-    "docs/",
+    "docs/*.md",
     "README.md",
     "STATUS.md",
     "THIRD-PARTY-NOTICES.txt",
@@ -44,9 +44,9 @@
     "install:claude": "npm run validate:claude && node scripts/install-claude.mjs"
   },
   "dependencies": {
-    "@wacando/contracts": "0.1.0-rc.1",
-    "@wacando/omemo": "0.1.0-rc.1",
-    "@wacando/xmpp": "0.1.0-rc.1",
+    "@wacando/contracts": "0.1.1",
+    "@wacando/omemo": "0.1.1",
+    "@wacando/xmpp": "0.1.1",
     "@xmpp/client": "0.14.0"
   },
   "publishConfig": {

package/packages/onboarding/version.mjs

@@ -1,2 +1,2 @@
 // Must match all distributed plugin manifests; checked by the test suite.
-export const pluginVersion = '2.0.0-rc.1';
+export const pluginVersion = '2.0.2';

package/packages/runtime/conversations.mjs

@@ -5,6 +5,7 @@ import {
 } from '@wacando/xmpp';
 import { ApiError } from '../onboarding/network.mjs';
 import { SafeError } from '../onboarding/storage.mjs';
+import { attachRecovery, recoveryLifecycle, recoveryView } from './recovery.mjs';
 
 // Consent-aware conversations (lbframe/wacando docs/CONVERSATION_CONSENT.md):
 // - a request's first message and every message of a gated (`service`) agent
@@ -120,6 +121,50 @@ export class ConversationClient {
     this.waiters = new Set();
     this.cancels = new Set();
     this.chain = Promise.resolve();
+    // lbframe/wacando#50: consumed-prekey session recovery, gated by the
+    // conversation lifecycle seen through the API (and by STOP on the server).
+    this.lifecycles = new Map(); // conversationId → 'active' | 'closed' | 'unknown'
+    this.recoveryStates = new Map(); // conversationId → recovery view
+    this.recovery = this.attachRecovery(session);
+    this.lifecyclesLoaded = this.loadLifecycles();
+  }
+
+  /**
+   * Learn every conversation's state at start-up (and after a reconnection),
+   * so recovery is not refused just because no tool call happened yet.
+   * Failures leave the state unknown, which denies recovery (fail closed).
+   */
+  async loadLifecycles() {
+    if (typeof this.runtime?.api !== 'function') return;
+    try {
+      const { conversations } = await this.runtime.api(this.agent, 'GET', '/v1/conversations');
+      for (const c of conversations ?? []) {
+        try { this.observe(conversationView(c, this.agent.agentId, this.domain)); } catch { /* not ours */ }
+      }
+    } catch { /* unknown stays unknown */ }
+  }
+
+  attachRecovery(session) {
+    return attachRecovery({
+      session,
+      policyJid: this.policyJid,
+      lifecycle: conversationId => this.lifecycles.get(conversationId) ?? 'unknown',
+      onStatus: event => this.recoveryStates.set(event.conversationId, recoveryView(event)),
+    });
+  }
+
+  /** Record what the API says about a conversation; STOP is terminal for recovery too. */
+  observe(view) {
+    const lifecycle = recoveryLifecycle(view.state);
+    this.lifecycles.set(view.id, lifecycle);
+    if (lifecycle === 'closed') this.recovery?.cancelConversation(view.id);
+    return view;
+  }
+
+  /** Recovery state of a conversation, when there is one to report. */
+  recoveryOf(conversationId) {
+    const state = this.recoveryStates.get(conversationId);
+    return state ? { recovery: { ...state } } : {};
   }
 
   /** Own sent text, kept in memory only and bounded (Signal cannot self-decrypt). */
@@ -131,7 +176,10 @@ export class ConversationClient {
   /** Continue on a new session of the same identity (after a reconnection). */
   rebind(session) {
     this.tracker.close();
+    this.recovery?.detach();
     this.session = session;
+    this.recovery = this.attachRecovery(session);
+    this.lifecyclesLoaded = this.loadLifecycles();
     this.tracker = new MucOriginTracker(session.client, { trustedRelayJid: this.policyJid });
     this.rooms.clear();
     for (const resolve of this.submissions.values()) resolve({ state: 'refused', reason: 'connection-lost' });
@@ -191,7 +239,7 @@ export class ConversationClient {
   async conversation(conversationId) {
     try {
       const { conversation } = await this.runtime.api(this.agent, 'GET', `/v1/conversations/${encodeURIComponent(conversationId)}`);
-      return conversationView(conversation, this.agent.agentId, this.domain);
+      return this.observe(conversationView(conversation, this.agent.agentId, this.domain));
     } catch (error) { throw apiFailure(error); }
   }
 
@@ -200,9 +248,9 @@ export class ConversationClient {
     let conversations;
     try { ({ conversations } = await this.runtime.api(this.agent, 'GET', '/v1/conversations')); }
     catch (error) { throw apiFailure(error); }
-    const views = conversations.map(c => conversationView(c, this.agent.agentId, this.domain));
+    const views = conversations.map(c => this.observe(conversationView(c, this.agent.agentId, this.domain)));
     return {
-      accepted: views.filter(v => v.accepted).map(v => publicConversation(v, { mode: this.rooms.get(v.id) ?? 'unknown' })),
+      accepted: views.filter(v => v.accepted).map(v => publicConversation(v, { mode: this.rooms.get(v.id) ?? 'unknown', ...this.recoveryOf(v.id) })),
       requests: views.filter(v => !v.accepted && v.role === 'requester' && v.state === 'requested').map(v => publicConversation(v)),
     };
   }
@@ -333,7 +381,7 @@ export class ConversationClient {
     if (mode === 'member') await this.catchUp(view);
     await this.chain;
     const messages = [...(this.transcripts.get(view.id)?.values() ?? [])].sort((a, b) => a.at.localeCompare(b.at));
-    return { conversation: publicConversation(view, { mode }), messages,
+    return { conversation: publicConversation(view, { mode, ...this.recoveryOf(view.id) }), messages,
       ...(mode === 'gated' ? { note: 'Gated (service) agents cannot read the archive: only messages delivered while this runtime was connected are listed.' } : {}) };
   }
 
@@ -379,6 +427,7 @@ export class ConversationClient {
 
   close() {
     this.tracker.close();
+    this.recovery?.detach();
     for (const cancel of [...this.cancels]) cancel(null);
   }
 }

package/packages/runtime/recovery.mjs

@@ -0,0 +1,49 @@
+import * as omemo from '@wacando/omemo';
+
+// Consumed-prekey session recovery (lbframe/wacando#50,
+// docs/OMEMO_SESSION_RECOVERY_IMPLEMENTATION.md there). The protocol lives in
+// @wacando/omemo (`SessionRecovery`): signed controls relayed ONLY by the
+// policy component, which enforces membership and STOP. The runtime supplies
+// the conversation lifecycle it learns from the API and surfaces the state.
+// A @wacando/omemo without SessionRecovery leaves recovery off: failures keep
+// failing closed exactly as before (no plaintext, no replay).
+
+/** Conversation state (API) → recovery lifecycle. Anything uncertain denies. */
+export function recoveryLifecycle(state) {
+  if (state === 'active') return 'active';
+  if (['closing', 'closed', 'expired', 'refused', 'failed'].includes(state)) return 'closed';
+  return 'unknown';
+}
+
+/**
+ * Attach recovery to one XMPP session. Returns null (recovery off, failures
+ * keep failing closed) when the installed @wacando/omemo does not provide it,
+ * when the session is not a native-OMEMO XMPP client able to answer IQs, or
+ * when attaching fails. `omemoModule` is injectable for tests.
+ */
+export function attachRecovery({ session, policyJid, lifecycle, onStatus, omemoModule = omemo }) {
+  const SessionRecovery = omemoModule.SessionRecovery;
+  if (typeof SessionRecovery?.attach !== 'function') return null;
+  const client = session?.client;
+  const backend = session?.provider?.backend;
+  if (typeof client?.iqCallee?.set !== 'function' || typeof client?.iqCaller?.set !== 'function') return null;
+  if (!backend?.state) return null; // native libsignal backend only
+  try {
+    return SessionRecovery.attach({ provider: session.provider, backend, entity: client, policyJid, lifecycle, onStatus });
+  } catch {
+    return null;
+  }
+}
+
+/**
+ * What an agent is told: a state and a content-free reason. A message whose
+ * delivery stays uncertain is never resent automatically; its id is listed
+ * so the agent can tell its owner and resend explicitly if needed.
+ */
+export function recoveryView(event) {
+  return {
+    state: event.status,
+    reason: event.reason ?? null,
+    ...(event.deliveryUncertain?.length ? { deliveryUncertain: [...event.deliveryUncertain] } : {}),
+  };
+}

package/plugins/wacando/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "wacando",
-  "version": "2.0.0-rc.1",
+  "version": "2.0.2",
   "description": "Connect agents with Wacando onboarding and view conversations in the built-in Codex browser.",
   "author": { "name": "Wacando" },
   "skills": "./skills/",

package/plugins/wacando-claude/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "wacando-claude",
   "displayName": "Wacando",
-  "version": "2.0.0-rc.1",
+  "version": "2.0.2",
   "description": "Connect agents with Wacando onboarding and view live Claude Code conversations locally.",
   "author": { "name": "Wacando" },
   "keywords": ["agents", "conversation", "local", "observability"],

package/plugins/wacando-cursor/.cursor-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "wacando-cursor",
   "displayName": "Wacando",
-  "version": "2.0.0-rc.1",
+  "version": "2.0.2",
   "description": "Connect agents with Wacando onboarding and view conversations in the built-in Cursor browser.",
   "author": { "name": "Wacando" },
   "keywords": ["agents", "conversation", "local", "observability"],

package/provenance.json

@@ -237,21 +237,21 @@
     },
     {
       "name": "@wacando/contracts",
-      "version": "0.1.0-rc.1",
+      "version": "0.1.1",
       "license": "UNLICENSED",
-      "integrity": "sha512-Po+XGRTBngwU1zyoeJwrpr5OQlLFWIAHTugoAdtjyTrL+f9ybQ7bTDR50FmMLuV4f/xx1lV2sVJ4EcB4qD24Vg=="
+      "integrity": "sha512-LGxpswKy76+I0CCXxS7NIAbkEqIGRT6gCM9EeguuJlYoUp+xMMBTLHQLbRZFc5Xo2Vg+UJvvh7lvLfB+6PacgQ=="
     },
     {
       "name": "@wacando/omemo",
-      "version": "0.1.0-rc.1",
+      "version": "0.1.1",
       "license": "UNLICENSED",
-      "integrity": "sha512-k+L2hasgFdA/sJMQW/nFP6gCa9xOiozLJeft8a5d/vGsItLibEVRbX79dAwI4wAPDSQW2L9WjQX4gnSsmAUWkQ=="
+      "integrity": "sha512-4qQqTBfaipB0rLzpfjz+LmPS/9+gf8oO8PU3B2me8zDppMhGoDaZ/0YAR6hETUPp0BKlx6VrvOZ4eqVmTKgSLQ=="
     },
     {
       "name": "@wacando/xmpp",
-      "version": "0.1.0-rc.1",
+      "version": "0.1.1",
       "license": "UNLICENSED",
-      "integrity": "sha512-4gM9NV699N+pNWomkTxDr+E1zyf2IdA2wdxumBj/Vqt1+50SV6B/p7q7f1kcHstvxwaFWgXziuHYplO8TtfUjQ=="
+      "integrity": "sha512-VjH+jkIZj5hfdtRZpRGv6FgSzpwB8CeQdnPH9mjlsS6b75YiOsIcHLF4wp67+GEGqHY3CMFJn9fk9ayes7JZxA=="
     },
     {
       "name": "@xmpp/base64",

package/docs/evidence/issue-2/DOCUMENTARY_FOLLOWUP.md

@@ -1,107 +0,0 @@
-# Issue #2 documentary follow-up — October 15, 2026
-
-Initial local and PR #9 HEAD: `24ace6ef95d4a4f595dd712b325a1fc7cbbba449`.
-Branch: `fix/cursor-identity-resume`. Repository: `lbframe/wacando-agent`
-(private; the local directory/remote retain the historical `wacando-plugin` name).
-PR #9 was OPEN/draft; plugin issue #2 and Wacando #17 were OPEN.
-
-King's explicit decision relayed in mission
-`1dc1a826-eefb-4610-bdfa-5027f88ab4d0`: issue #2 acceptance covers identity
-resume and revocation through all three runtime profiles on real
-Postgres/ejabberd/OMEMO. Actual Cursor/Codex/Claude CLI qualification is deferred
-to [Wacando #17](https://github.com/lbframe/wacando/issues/17).
-Independent review is pending. This is an acceptance-scope correction, not a
-new implementation or a change to recorded outcomes.
-
-| Evidence | Observed outcome | Acceptance scope |
-| --- | --- | --- |
-| [Original live runtime suite](local-live.txt) | 3 passed, 0 failed, 0 skipped: codex, cursor, claude runtime profiles | PASS for issue #2 runtime resume/revocation; no actual CLI claim |
-| [Original full live check](local-check.txt) | 57 passed, 0 failed, 0 skipped | Existing regression and runtime acceptance evidence |
-| [Cursor checker](local-cursor.txt), [probe](local-cursor-probe.txt) | Exit 1 before confirmed MCP; EROFS writing host sandbox-policy state | Cursor CLI NOT QUALIFIED in the sandbox; never PASS |
-| [Codex checker](local-codex.txt), [initial probe](local-codex-probe.txt), [second probe](local-codex-probe2.txt) | Exit 1 before confirmed MCP; read-only filesystem initializing app-server | Codex CLI NOT QUALIFIED in the sandbox; never PASS |
-| Actual Claude CLI | No onboarding/resume attempt recorded in this evidence | Claude CLI NOT QUALIFIED in the sandbox; runtime PASS is separate |
-| [Documentary follow-up check](documentary-check.txt) | Exit 0; 54 passed, 0 failed, 3 skipped | Current build/generated-runtime/regression check; live stack not restarted |
-
-All previously committed raw outputs remain byte-for-byte unchanged. The
-[manual procedure](../../CURSOR_IDENTITY_RESUME.md#manual-cli-qualification-after-host-restart)
-provides exact per-CLI launch commands, a consumed-token placeholder, private
-local fingerprint comparison, normal shutdown and fresh-host revocation
-rejection. It was not executed here. The prior CLI `--help` success assertion
-is withdrawn below; no CLI or MCP qualification follows from help output.
-
-## Commands and results for this follow-up
-
-From the plugin checkout:
-
-```sh
-git branch --show-current
-git rev-parse HEAD
-git ls-remote origin refs/heads/fix/cursor-identity-resume
-gh pr view 9 --repo lbframe/wacando-agent --json title,body,headRefName,headRefOid,isDraft,state,url
-gh issue view 2 --repo lbframe/wacando-agent --json title,body,state,url
-gh issue view 17 --repo lbframe/wacando --json title,body,state,url
-gh issue view 42 --repo lbframe/wacando --json title,body,state,url
-```
-
-Exit 0. Local branch `fix/cursor-identity-resume`, local/remote/PR initial HEAD
-`24ace6ef95d4a4f595dd712b325a1fc7cbbba449`, draft/open PR and open issues
-confirmed. Initial bodies incorrectly treated CLI qualification as an issue #2
-acceptance blocker. Wacando #17's existing blockers are agent #3/#4 and service
-#12/#16/#40/#37; #42's existing blockers are #40/#37. Plugin #2 has no recorded
-blocked-by dependency. These dependency edges are preserved.
-
-```sh
-timeout 20s codex --help
-timeout 20s codex exec --help
-timeout 20s cursor-agent --help
-```
-
-Historical claims only; these are not archived execution evidence.
-Correction after independent review: no raw outputs for these commands were
-archived. The previous blanket exit-0/flag-verification claim is unsupported
-and withdrawn, including for Claude; this evidence does not establish that
-`claude` was available. The previously quoted Codex warning also has no archived
-help transcript here. Check flags on each target host before executing the
-manual procedure. That earlier follow-up claimed no supported help verification.
-The later [completion record](QUALIFICATION_LINK_FOLLOWUP.md) archives new safe
-Cursor/Codex help outputs only; no `claude --help` run or CLI qualification is claimed.
-
-```sh
-env -u WACANDO_LIVE_TEST_ORIGIN npm_config_cache=/tmp/wacando-issue2-npm-cache timeout 600s npm run check
-```
-
-Exit 0; [complete output](documentary-check.txt). Build and all three exact
-runtime checks pass. Tests: 57 total, 54 pass, 0 fail, 3 live cases skipped.
-No independent lint/typecheck script exists. The existing live PASS is retained;
-this run made no API request and did not recreate the retired ephemeral stack.
-
-[Document checks](documentary-validation.txt) record link targets, shell/Node
-syntax, unchanged prior evidence and the docs-only diff. The revocation wording
-claim in that record was too broad: it checked a message from the wrong path
-for an already-saved identity, and is corrected by the
-[review follow-up](REVIEW_FOLLOWUP.md).
-
-The successful `git diff --check` claim applies to the documentary follow-up
-`24ace6ef95d4a4f595dd712b325a1fc7cbbba449..abd3e52a285808df5b4cc3e1f53621421ef9b316`,
-not the cumulative PR diff `origin/main...HEAD`. That cumulative diff contains
-trailing whitespace in preserved raw evidence logs and exits 2; the logs must
-remain byte-for-byte unchanged.
-The final PR/issue bodies preserve the scope split, draft/open state, and #42
-retirement dependency. The worker supplies checks and evidence; independent
-review is a separate next step, not performed here.
-
-## Residual limits
-
-Actual CLIs are NOT QUALIFIED in the sandbox. Their current EROFS results are
-not successful enrollment/resume, and no new CLI onboarding/reboot/revocation
-run is claimed. Crash locks, the 45-second cleanup cap, host UIs, macOS/Windows,
-encrypted conversation exchange, replacement app/pairing flow and production
-remain outside this follow-up's validation. No lock was removed, no credentials
-were requested or copied, and no host installation/configuration was changed.
-No merge or publication occurred.
-
-The [Wacando #42](https://github.com/lbframe/wacando/issues/42) retirement
-dependency remains: v1 web onboarding and its prompt builder support the current
-fixture/procedure. Coordinate #17 with that retirement: once the web flow is removed, initial
-setup must use the approved replacement app/pairing flow. This evidence does
-not qualify the replacement or add a dependency edge to #42.

package/docs/evidence/issue-2/QUALIFICATION_LINK_FOLLOWUP.md

@@ -1,105 +0,0 @@
-# Qualification-link completion — October 15, 2026
-
-Task `58463914-cf55-4d12-8f7b-f736dd97e3f0`, PR #9, branch
-`fix/cursor-identity-resume`. The requested starting HEAD was
-`abd3e52a285808df5b4cc3e1f53621421ef9b316`. A concurrent task left local commit
-`24159b9c1724c8a2ae9b59386ea7e7c1e32bc147` with the saved-identity wording
-correction and checks, then stopped. This completion retains that documentation
-and adds immutable links and the authorized PR/issue body corrections.
-Independent follow-up review and merge remain pending; no runtime edit,
-publication, merge or issue close is part of this work.
-
-## Corrected acceptance
-
-The [review correction](REVIEW_FOLLOWUP.md) traces `enroll()` with saved state
-to `open()`, whose line 189 returns:
-
-```text
-Agent revoked or durable access rejected. Connection attempts have stopped. Check the identity on the site.
-```
-
-After that rejection has persisted local revocation, line 72 instead returns:
-
-```text
-Agent revoked. Connection attempts have stopped. Create a new identity on the site.
-```
-
-Line 81's shorter message belongs to first enrollment, not the saved-identity
-scenario. The live test asserts `/Agent revoked/`; the procedure requires an
-actual error result matching `/^Agent revoked[. ]/`, without affirmative
-connection, after prior successful resume and confirmed owner revocation of the
-same identity. It also requires responsive host, normal cleanup and identical
-private-identity fingerprint. The message alone covers other access denials
-and cannot prove owner revocation. This is source tracing, not a manual test.
-`qualification_origin` must be exactly `URL.origin`, including scheme, host and
-optional port, without trailing slash/path; the literal partition hash otherwise
-differs and the helper fails closed.
-
-## Durable references and GitHub bodies
-
-The procedure document, PR #9 body, plugin #2 body and Wacando #17 checklist
-use the immutable original reviewed snapshot at
-`abd3e52a285808df5b4cc3e1f53621421ef9b316` instead of branch links. That snapshot
-predates the wording correction: the current document and updated bodies state
-the corrected acceptance explicitly. It is not a newly executed qualification.
-
-The first three #2 boxes describe proven runtime acceptance and are checked;
-independent follow-up review/merge stays unchecked, with #2 OPEN/in progress and
-PR #9 OPEN/draft. All #17 qualification boxes remain unchecked. The #17 blocker
-line and native dependencies are preserved exactly; #42 remains a retirement
-coordination dependency with its existing blockers #40/#37. No dependency edge
-is added or removed. API read-back results are recorded in
-[body verification](qualification-body-validation.txt).
-
-## Commands and real results
-
-Safe help only, no prompt or MCP invocation:
-
-```sh
-timeout 20s codex --help
-timeout 20s codex exec --help
-timeout 20s cursor-agent --help
-```
-
-Each exited 0. Complete combined stdout/stderr is stored losslessly as the
-`combined_output` JSON string in [Codex](codex-help.json),
-[Codex exec](codex-exec-help.json), and [Cursor](cursor-help.json). Decode that
-string for exact bytes, including padded blank lines. Codex emits its read-only
-PATH-alias warning. Cursor's `--workspace`/`--plugin-dir` and Codex's `-C`/prompt
-syntax are present. These are new help runs, not proof of the prior unarchived
-claims or of CLI qualification. No `claude --help` was run; its flags remain
-unverified. Claude's absence from the reviewer's PATH is not contradicted by
-availability in another runtime.
-
-```sh
-env -u WACANDO_LIVE_TEST_ORIGIN npm_config_cache=/tmp/wacando-issue2-npm-cache timeout 600s npm run check
-```
-
-Exit 0, [complete output](qualification-link-check.txt): 57 tests, **54 passed,
-0 failed, 3 live cases skipped**, with build/generated equality passing. No
-separate lint/typecheck scripts exist. No new MCP/packaging implementation
-change justifies another Inspector run.
-
-[Document validation](qualification-link-validation.txt) records actual local
-link/anchor checks, shell/Node syntax checks without executing the procedure,
-raw evidence byte equality, docs-only scope and whitespace results. The
-historical `git diff --check 24ace6e..abd3e52` passes only that delta. The current
-follow-up `git diff --check abd3e52` passes separately. The cumulative PR diff
-`git diff --check origin/main` still exits 2 for preserved raw evidence logs;
-those logs remain byte-identical. No full-PR whitespace PASS is claimed.
-
-## Remaining untested items
-
-The manual restart procedure is **NOT EXECUTED**. Actual Cursor/Codex/Claude CLI
-verification, host restart/reboot, identity resume, event-shape compatibility and
-owner revocation remain **NOT QUALIFIED in this sandbox**, deferred to
-[Wacando #17](https://github.com/lbframe/wacando/issues/17). Prior Cursor/Codex
-EROFS failures remain failures, and Claude onboarding has no recorded attempt.
-Existing real API/Postgres/ejabberd/OMEMO runtime acceptance is retained; no live
-stack/API/CLI procedure was rerun. Crash locks, SIGKILL/short host deadlines,
-the 45-second cleanup cap, host UIs, macOS/Windows, encrypted conversation
-exchange, replacement app/pairing flow and production remain untested.
-[#42](https://github.com/lbframe/wacando/issues/42) still requires coordinating
-retirement of v1 web onboarding/prompt building with #17's initial setup.
-No host configuration or installation was changed, credentials accessed, lock
-removed, permission widened, package published, merge performed or issue closed.

package/docs/evidence/issue-2/REVIEW_FOLLOWUP.md

@@ -1,93 +0,0 @@
-# PR #9 review corrections — October 15, 2026
-
-Starting HEAD: `abd3e52a285808df5b4cc3e1f53621421ef9b316`, existing branch
-`fix/cursor-identity-resume`. Local documentation correction only, prepared for
-independent review of [PR #9](https://github.com/lbframe/wacando-agent/pull/9).
-At local commit `24159b9`, no push, publication, GitHub comment/review/body edit,
-merge or issue closure had occurred. That earlier task left acceptance boxes and
-branch-based external evidence links unchanged. The subsequent
-[completion record](QUALIFICATION_LINK_FOLLOWUP.md) records the broader authorized
-follow-up: immutable links and bodies, with proven runtime boxes checked and
-review/merge still pending. This note preserves the earlier check scope.
-
-## MEDIUM-1: follow the saved-identity path
-
-The manual procedure first proves resume with the same saved identity and an
-unusable token. `enroll()` reads that identity, skips initial token redemption,
-and calls `open()` (`packages/onboarding/service.mjs:72–99`). In a fresh host,
-`open()` requests `/v1/xmpp/session`; HTTP 403/`AGENT_REVOKED` becomes `ApiError`
-in `network.mjs:39`. Its catch stops retries, persists `revoked: true` and throws
-at `service.mjs:189`:
-
-```text
-Agent revoked or durable access rejected. Connection attempts have stopped. Check the identity on the site.
-```
-
-If background recovery has already persisted revocation, the guard at line 72
-instead throws:
-
-```text
-Agent revoked. Connection attempts have stopped. Create a new identity on the site.
-```
-
-Line 81's shorter message belongs to initial enrollment without saved agent
-state. It was the wrong expected output for this scenario. The revised procedure
-requires an actual MCP tool error (`packages/mcp/server.mjs:98`), the anchored
-`/^Agent revoked[. ]/` prefix (`scripts/host-result.mjs:20`), and no affirmative
-connection. The live test uses `/Agent revoked/` (`tests/onboarding-live.test.mjs:71`);
-it is existing runtime evidence, not a newly executed CLI qualification.
-
-An error string alone cannot establish owner revocation: `open()` also rejects
-other HTTP 401/403 access denials. The procedure additionally requires confirmed
-owner-UI revocation of the same previously resumed identity, exactly one actual
-tool result, a responsive host, unchanged private-identity fingerprint and normal
-lock cleanup. Missing results, generic failures, timeouts and host prose cannot
-pass. No implementation or generated file was changed.
-
-## LOW corrections and evidence scope
-
-- `qualification_origin` must exactly equal `new URL(configuredApiUrl).origin`.
-  `enroll()` and `CredentialStore.directory()` partition on that normalized
-  origin; the manual fingerprint function hashes the supplied string literally.
-  A trailing slash or other normalization difference selects the wrong directory
-  and fails closed. The procedure now gives the exact requirement and an example.
-- The earlier `--help` exit-0 assertion has no archived outputs. It is withdrawn
-  in both authored documents, including the Claude claim. No new help run is
-  claimed. Launch flags must be checked on the target host; this correction
-  establishes neither Claude availability nor CLI qualification.
-- The historical documentary whitespace check covers `24ace6e..abd3e52`, not
-  the cumulative PR. That historical range and the present follow-up pass.
-  `origin/main...abd3e52` exits 2 for whitespace in preserved raw evidence logs.
-  Those bytes are intentionally retained; the cumulative result is a residual
-  evidence-format limitation, not a new implementation failure.
-- The previous validation record's wording check was incorrect for the scenario;
-  its claim is explicitly corrected, rather than reused as proof.
-
-## Commands and actual results
-
-Required repository check, run in the foreground with a ten-minute bound:
-
-```sh
-env -u WACANDO_LIVE_TEST_ORIGIN npm_config_cache=/tmp/wacando-issue2-npm-cache timeout 600s npm run check
-```
-
-Exit 0. [Complete raw output](review-check.txt): build and all three exact
-runtime checks pass; 57 tests, 54 pass, 0 fail, 3 live cases skipped. No separate
-lint/typecheck scripts exist. The build reproduced the committed generated
-files without changing them. No MCP/packaging implementation change was made,
-so `check:mcp` was not rerun.
-
-[Documentary validation](review-validation.txt) contains actual source-path,
-local-link, shell/Node syntax, evidence-byte and whitespace check results,
-including the full cumulative whitespace diagnostics. Syntax checking did not
-execute the operator's procedure. All 22 files present at `24ace6e`, plus the
-prior documentary check log, are byte-for-byte preserved.
-
-Actual Cursor/Codex/Claude CLI enrollment, restart/reboot, resume and revocation
-remain NOT QUALIFIED in this sandbox; prior EROFS limitations remain. No live
-API/XMPP stack was restarted for this correction. Existing runtime acceptance
-evidence is unchanged. Independent review of this local correction is pending.
-[Wacando #17](https://github.com/lbframe/wacando/issues/17) owns CLI qualification;
-[Wacando #42](https://github.com/lbframe/wacando/issues/42) still owns retirement
-of the v1 web onboarding/prompt-builder dependency. Future app/pairing flow,
-crash locks, host UIs, other platforms and production remain untested.