carthagent 1.0.7 → 1.1.0-beta.2

package/docs/beta-rewards-e2e-plan.md

@@ -0,0 +1,48 @@
+# Beta rewards and new-user acceptance
+
+Owner-approved policy: one eligible `ctg` verified delivery earns **25 coins,
+100 XP and 1 km**, at most three grants per player per UTC day. Daily classifier
+assessment and personal work-log completion do not earn these rewards.
+
+## Execution plan
+
+1. Preserve the current live account and capture its starting profile. Confirm
+   account identity through normal authentication; never select an account by
+   a display name supplied to a public endpoint.
+2. Implement a versioned backend reward receipt and atomic coin/XP/km posting.
+   Derive owner from authentication and amounts from server policy. Retain
+   delivery identity across retries and enforce daily caps under a player lock.
+3. Integrate an explicit native claim action. Require a current required-check
+   verified handoff, fresh source fingerprint, passing check/requirement/review
+   gates and stable project/run identity. Do not reward advisory or blocked work.
+4. Run a disposable real-PostgreSQL lifecycle through normal HTTP/auth routes:
+   new user, one welcome grant, isolation, eligible reward, exact replay,
+   conflicting/parallel claims, daily cap, rollback, level/week boundaries,
+   purchase/equip and application/database reconnect persistence. Exercise
+   rejection paths and reconcile wallet postings against balances.
+5. Run backend checks and native eligibility/RPC/UI checks. Deploy the backend
+   only via reviewed PR, merge and its existing deployment workflow.
+6. On the owner's Beshir Aissi account, claim the existing accepted Ship delivery
+   once; replay it; confirm exactly +25 coins/+100 XP/+1 km, then compare native
+   and web persisted state. Keep test fixtures separate from earned live records.
+7. Record actual results, limitations and exact revisions, then resume beta
+   publication with installed-package and public-runtime acceptance gates.
+
+## Trust boundary
+
+The coding harness verifies local execution and source freshness. An authenticated
+client transmits a bounded receipt; the backend does not independently execute
+the repository. Client attestation is not remote execution attestation or proof
+of authorship. Server amounts, owner isolation, durable deduplication and caps
+must hold even for malformed or replayed clients. Tests must not equate a private
+debug coin grant with an earned coding reward.
+
+## Original baseline
+
+Live profile previously verified: 20 coins, 0 XP, sandals owned/equipped. Current
+backend has no coding-reward path. Quest policy explicitly returns `rewards:false`.
+Beta publication is held until this additional acceptance scope is resolved.
+
+Execution results are recorded in [beta-rewards-e2e-results.md](beta-rewards-e2e-results.md).
+Production earned claim/replay/restart acceptance now passes at 45 coins,
+100 XP and 1 km; live browser and release-package acceptance remain pending.

package/docs/beta-rewards-e2e-results.md

@@ -0,0 +1,84 @@
+# Beta reward acceptance results
+
+## Production earned reward — passed
+
+Tested November 2, 2026 UTC through the normal installed profile, authenticated
+as the owner's Beshir Aissi account. The installation is still preview.13 with
+labelled local launch/reward patches; these results are not installed-beta
+release acceptance.
+
+- Backend PR [#176](https://github.com/B-icy/Carthagent-Backend/pull/176), merged
+  revision `ec40fdb9b053e64b820adb18e7d35da927468149`.
+- [Production deployment](https://github.com/B-icy/Carthagent-Backend/actions/runs/41401836218)
+  passed migration/readiness, public-site and service checks.
+- Native preview accepted the real required-check Ship delivery
+  `903d3ed5-88db-41ca-b72d-f5699fa5ae7f`, source snapshot
+  `cea9b1d71e113d0b876cec4d3a2eef38f16e14decb519d033fb7d9325508b8bb`.
+- Claim receipt `9d44cf4b-0a70-40e5-90ce-d68a7718fe21`, awarded
+  `2026-11-02T06:49:23.538Z`, policy `verified-delivery-beta-v1`.
+
+| Check | Before | After |
+| --- | --- | --- |
+| Coins | 20 | 45 |
+| Total XP | 0 | 100 |
+| Total / weekly km | 0 / 0 | 1 / 1 |
+| Profile version | 14 | 15 |
+| Equipment / inventory | Sandals equipped | Identical, sandals retained |
+
+Immediate replay returned the identical receipt with `replayed:true` and no
+additional grant. After stopping and restarting the registered native service,
+preview, replay and profile all matched the saved post-claim result exactly.
+Sessions and credentials persisted. No debug issuance was used.
+
+The live TUI displayed 45 coins / 100 XP / 1 km, rendered the digest-only claim
+confirmation, accepted cancellation, and then confirmed the existing receipt
+with “This delivery was already rewarded. No duplicate grant.” The wallet and
+version stayed unchanged. Captures: `/tmp/opencode/rewards-ui-preview.txt` and
+`/tmp/opencode/rewards-ui-replayed.txt`.
+
+## Repeatable new-user acceptance — passed locally
+
+Disposable PostgreSQL 17.11: 117 tests passed before the additional bearer
+scenario; the complete six-test bearer group also passed. Backend CI ran the
+updated suite successfully. Backend unit tests: 521 passed, one skipped.
+Syntax, assets and navigation checks passed.
+
+Coverage includes one welcome grant, cookie and device-approved bearer access,
+reward claims and browser/CLI agreement, token refresh/new CLI session, owner
+isolation, concurrent daily caps, run/snapshot deduplication, changed-evidence
+rejection, transaction and wallet-overflow rollback, level/week progression,
+milestone shop/quote/equip agreement, purchase replay, database reconnect and
+restricted deployment/application-role permissions.
+
+Native build/lint and 76 focused tests passed, including explicit confirmation,
+account/session binding, current source gates, privacy of digest-only uploads,
+lost-response recovery, restart and receipt recovery after source changes.
+
+## Remaining acceptance gates
+
+- Live browser comparison awaits normal user sign-in in `voyages-rewards-e2e`.
+- Live terminal rendering, cancellation and confirmed replay passed.
+- Five-platform runtime prebuild 41398315323 succeeded on attempt 2. Exact
+  provenance, all archive checksums, embedded metadata and executable hashes
+  passed the production acquisition parser; regenerating the manifest produced
+  the identical candidate. The packaged beta manifest now matches those bytes.
+  Installed beta acceptance remains pending.
+
+Pre-manifest full native quality run: lint/build passed; 1,124 tests passed, five
+skipped, six failed solely because the package version is beta.1 while the
+runtime manifest still pins preview.13. These remain release-blocking failures
+until the verified beta candidate was integrated. The post-integration quality
+run passed: **1,130 tests passed, five skipped, zero failures**, plus lint,
+typecheck and build. Exact candidate/packaged manifest equality and
+`verify-release-version.mjs v1.1.0-beta.1` also passed. No trust assertion was relaxed.
+
+Native PR CI passed all jobs after retrying one Windows Node 24 process-query
+timeout. Native navigation also passed locally: 12 tests / 65 assertions.
+
+The reward backend relies on authenticated local-harness attestation. It does
+not independently execute repositories or prove authorship. Daily classifier
+assessment and personal quest checkmarks remain unrewarded.
+
+Local evidence: `/tmp/opencode/rewards-live-claimed.json`,
+`/tmp/opencode/rewards-live-restarted.json`, and
+`/tmp/opencode/rewards-installed-backup/provenance.json`.

package/docs/cloud-onboarding-acceptance.md

@@ -0,0 +1,65 @@
+# Cloud onboarding — unreleased implementation
+
+November 2, 2026. This branch is not published beta acceptance. npm `next` remains
+1.1.0-beta.1 and `latest` remains 1.0.7.
+
+Native PR #238 merged at `a5ad2164d056fee7f7183579ce6cc97305bae53b` after CI
+41504674623 passed. First-task guidance is tracked in PR #239. Beta.2 runtime
+prebuild 41505735348 succeeded. All five downloaded archives, executable digests
+and pinned provenance were independently verified by regenerating the candidate
+manifest locally. Package and lockfile target beta.2 and pin that exact manifest;
+publication remains pending.
+
+## Changes
+
+- Use Carthagent Cloud for hosted models; retain Ship mode, internal IDs and
+  compatibility login aliases.
+- Fresh device sign-in has one primary flow. Legacy import and upstream key
+  configuration require `CARTHAGENT_ADVANCED_AUTH=1`.
+- Billing selects Builder/Pro/Max and retrieves authenticated server quote terms.
+  TUI review precedes opening checkout. Existing subscribers review exact Stripe
+  proration in the browser before confirming a change.
+- `/billing refresh` and `ctg billing refresh` show current account access and
+  require explicit continuation in the existing task session.
+- Cloud account text identifies the signed-in email; usage recovery distinguishes
+  starter credit, daily/monthly limits, billing and own-provider access.
+
+## Verification
+
+- Full native suite: 1,131 passed, 5 skipped, 0 failed.
+  `/tmp/opencode/onboarding-native-reviewed.log`
+- Native build and typecheck pass.
+  `/tmp/opencode/onboarding-native-reviewed-build.log`
+- RPC regression verifies that eligibility comes from the authenticated server
+  and quoting does not create a checkout.
+- Native host acceptance passes at `b715ff282b` after correcting stale fresh-auth
+  and Cloud-name expectations. Both CI installed-package jobs passed. Run
+  41502591162 passed Linux/macOS and Windows 24; Windows 22 hit the two-second
+  PowerShell diagnostics timeout, while its parallel run passed. Windows
+  diagnostics now allow bounded ten-second cold startup.
+- Installed package acceptance and its focused terminal rerun reproduced a
+  reconnect overlay. DEBUG-enabled source and installed probes passed; a normal
+  source run subsequently hit its existing terminal-snapshot deadline. This is
+  timing-sensitive local acceptance, not proof of a fixed runtime defect. Both
+  earlier CI package checks passed, and corrected CI passed before merge.
+- The subsequent full non-focused installed-package run passed all 28
+  probes/scenarios, including terminal semantics, using the package-pinned
+  beta.1 owned runtime (`/tmp/opencode/onboarding-native-package-final.log`).
+  This closes the local rerun gate for the onboarding source; beta.2 still
+  requires acceptance against its own final packaged manifest and release assets.
+
+## Outstanding gates
+
+Backend counterpart: `B-icy/Carthagent-Backend` PR #178 merged at
+`b0eacdcbdb71be4c099b1b3839a11164b2d69232`; production deployment 41502378359
+succeeded. Its `ONBOARDING_CONVERSION_AUDIT.md` tracks the full matrix. Live
+authenticated identity and read-only Builder/Pro/Max handoff terms were verified.
+Retention follow-up PR #179 also merged and deployment 41505976672 succeeded.
+Stripe test access is unavailable. First-task/default-model guidance,
+contextual exhaustion action, remaining legacy/docs naming and full measurement
+segmentation still need work. No new end-to-end paid continuation or visual
+screenshot acceptance is claimed.
+
+The deployed website now precedes the native release. Publish a new immutable
+beta and verify its exact public acquisition and upgrade. Preserve the user's
+normal profile and Invest-With-Friends work during acceptance.

package/docs/glyph-review/host-chrome-glyph-compatibility-v4.md

@@ -0,0 +1,83 @@
+# Host TUI glyph compatibility review (v4)
+
+## Decision
+
+The standalone owned-host glyph compatibility patch was independently approved
+at SHA-256
+`37d93c0dfd5c52bd4536136fb53618580a29d682644848433f3b2ee4726d98a4`.
+The parent also reports that its full 11-test focused run passed with 146
+assertions. This record publishes the reviewed patch and its Unicode source
+inventory for later composition; it does not claim that the patch is already
+included in the current upstream runtime or in a final binary.
+
+## Artifacts
+
+- Patch: [`../patches/opencode-v2.0.32-glyphs.patch`](../patches/opencode-v2.0.32-glyphs.patch)
+  - SHA-256: `37d93c0dfd5c52bd4536136fb53618580a29d682644848433f3b2ee4726d98a4`
+  - Source base: upstream commit
+    `843a6c514e606b436a7fe713422ace0a93ad3d61`.
+- Inventory: [`unicode-inventory-v4.csv`](unicode-inventory-v4.csv)
+  - SHA-256: `8727e2cc18f47a3cfe986adc9f721ccaf4bef8f4f39046a7667bc9d6c5bf2fb3`.
+
+The patch changes 74 paths: 72 modified source/test files and two added files
+(`packages/tui/src/ui/glyphs.ts` and `packages/tui/test/glyphs.test.ts`). The
+independent review described its source-file audit as 72 changed files; the
+author's 74-file count includes those two additions. Both figures refer to the
+same v4 patch, not different revisions.
+
+## Scope and inventory
+
+The inventory scanned all 245 non-mini `packages/tui/src` TypeScript and TSX
+files. It records 401 Unicode-bearing source lines in 77 files, with zero
+unclassified rows. The classifications distinguish known host chrome from
+dynamic/user/model/code content, examples, and comments. Mini remains out of
+scope except where shared with the full TUI. Unicode remains the default;
+`auto` stays Unicode until a launcher resolves it. Only known static chrome is
+mapped, preserving dynamic text, paths, shell output, and diffs.
+
+## Review and validation evidence
+
+- Independent review approved the exact v4 patch hash above. Its blocking v3
+  findings (missing `chromeEllipsis` imports) are fixed in the three affected
+  consumers: `dialog-session-list.tsx`, `prompt/autocomplete.tsx`, and
+  `prompt/index.tsx`.
+- Focused tests: 11 passed, 0 failed, 146 assertions. The session-list test
+  executes the relative-path truncation helper in ASCII and Unicode modes and
+  checks that dynamic path characters remain intact.
+- Glyph-helper binding audit: zero missing bindings across the patch's 74
+  changed paths (including the two additions).
+- TypeScript transpilation: 74 changed TS/TSX files, zero transpilation errors.
+- `git diff --check`: passed.
+- Typecheck was compared against the pinned upstream base, not treated as a
+  clean pass. Both base and v4 emitted exactly the same single diagnostic:
+  `src/plugin/api.tsx(152,3): error TS2741: Property 'transcript' is missing in
+  type ... but required in type 'Context'.` No changed-file diagnostic
+  remained. Captured outputs:
+  [`typecheck-base.log`](typecheck-base.log) and
+  [`typecheck-v4.log`](typecheck-v4.log).
+
+Commands used for the focused checks (from `packages/tui` in the isolated
+upstream worktree):
+
+```sh
+/tmp/opencode/ctg-parity-prototype/bun-dist/bun-linux-x64/bun test --timeout 30000 test/glyphs.test.ts
+/tmp/opencode/ctg-parity-prototype/bun-dist/bun-linux-x64/bun /tmp/opencode/audit-glyph-bindings.ts
+/tmp/opencode/ctg-parity-prototype/bun-dist/bun /tmp/opencode/transpile-changed.ts
+git diff --check
+```
+
+The test result above is the owner's run. The binding and transpilation audits
+were run from the isolated source worktree. The workspace typecheck command
+was `tsgo --noEmit --pretty false -p tsconfig.json` on both base and v4; the
+captured logs preserve the complete (single-line) diagnostic. These checks are
+source-level evidence only and are not a final composed-runtime or release
+binary validation.
+
+## Composition boundary
+
+The migration product branch may separately own composition into its runtime.
+This documentation-only review change intentionally does not alter build or
+release recipes, CLI resolution, CTG integration code, or the source patch
+payload. The immutable patch and inventory should be the inputs to that
+composition; do not edit this published v4 revision in place. Any source
+revision requires a new patch filename and digest.

package/docs/glyph-review/test-isolation-v1.md

@@ -0,0 +1,26 @@
+# Spinner test import-order follow-up (v1)
+
+The composed 81e test run exposed an import-order assumption in the spinner
+assertion: `SPINNER_FRAMES` is initialized when its module is first imported,
+so setting `CTG_TUI_GLYPHS` later in a test does not change that constant. The
+production startup-time behavior is intentional and unchanged. The follow-up
+patch, [`../patches/opencode-v2.0.32-glyph-spinner-test-isolation-v1.patch`](../patches/opencode-v2.0.32-glyph-spinner-test-isolation-v1.patch),
+checks ASCII and Unicode startup values in separate Bun subprocesses with the
+mode set in each child's environment before import.
+
+Patch SHA-256:
+`651f4d08959ed657c94fc77fb6af48992b928f2b63eb922719f34dcb38cd8f26`.
+
+## Validation on Bun 1.4.2
+
+- Glyph tests: 11 passed, 0 failed, 147 assertions.
+- Combined glyph, plugin-keymap, and plugin-theme tests with a 60-second
+  per-test timeout: 18 passed, 0 failed, 168 assertions.
+- The same combined invocation with the suite's 30-second default had one
+  plugin-keymap timeout; rerunning at 60 seconds passed. No production code or
+  spinner initialization was changed.
+
+The subprocess assertions set the selected mode before importing
+`spinner-frames.ts`; this preserves and verifies the startup-time constant
+contract in both ASCII and Unicode modes despite other test modules being able
+to import the module earlier in the parent process.

package/docs/glyph-review/typecheck-base.log

@@ -0,0 +1 @@
+src/plugin/api.tsx(152,3): error TS2741: Property 'transcript' is missing in type '{ options: Readonly<Record<string, any>>; readonly location: LocationPublicInfo | undefined; app: { version: string; channel: string; }; renderer: CliRenderer; ... 8 more ...; ui: { ...; }; }' but required in type 'Context'.

package/docs/glyph-review/typecheck-v4.log

@@ -0,0 +1 @@
+src/plugin/api.tsx(152,3): error TS2741: Property 'transcript' is missing in type '{ options: Readonly<Record<string, any>>; readonly location: LocationPublicInfo | undefined; app: { version: string; channel: string; }; renderer: CliRenderer; ... 8 more ...; ui: { ...; }; }' but required in type 'Context'.