carthagent 1.1.0-beta.2 → 1.1.0-beta.4

package/docs/beta2-published-acceptance.md

@@ -0,0 +1,79 @@
+# Beta.2 release acceptance
+
+November 2, 2026. Immutable tag `v1.1.0-beta.2` points to
+`e14aeb17c213a927a27e9522da65db5928219647`.
+
+## Completed
+
+- Native onboarding PR #238 and first-task guidance PR #239 merged. Release PR
+  #240 merged with tag ancestry preserved at `fc5382364f41b1563ed137ed0db0c5711e041a83`.
+- Five-platform prebuild [41505735348](https://github.com/B-icy/Carthagent/actions/runs/41505735348)
+  passed. Local manifest regeneration verified all archive/executable hashes and
+  embedded provenance against the pinned runtime recipe.
+- Release CI [41509102387](https://github.com/B-icy/Carthagent/actions/runs/41509102387)
+  passed across Linux, macOS and Windows, including installed-package acceptance.
+- Final draft acceptance [41511681097](https://github.com/B-icy/Carthagent/actions/runs/41511681097)
+  passed against the exact tag, assets and main ancestry.
+- GitHub prerelease is public with five runtime archives, the manifest and
+  combined checksums. Independent anonymous verification of all five public
+  archives passed.
+- Release workflow [41512736590](https://github.com/B-icy/Carthagent/actions/runs/41512736590)
+  passed anonymous installed-package acceptance and reports successful npm
+  publication with signed provenance (transparency log index 3648230788).
+- Backend onboarding #178 and retention reporting #179 are deployed. Live
+  authenticated account identity and read-only plan terms were verified earlier.
+
+## npm publication verified
+
+After the workflow reported `+ carthagent@1.1.0-beta.2`, public registry requests
+from the acceptance environment still returned 404 for that exact version.
+Both npm CLI and cache-bypassed package metadata initially reported
+`next=1.1.0-beta.1`, `latest=1.0.7`. Registry visibility subsequently converged;
+no repeat publication was attempted.
+
+The public beta.2 tarball's SHA-512 matches registry integrity and the provenance
+subject digest. Sigstore verification passed for the GitHub Actions issuer and
+the repository's `release.yml@refs/heads/main` identity. The statement identifies
+release workflow 41512736590, and package `gitHead` matches the immutable tag.
+Verified tags: `next=1.1.0-beta.2`, `latest=1.0.7`.
+Evidence: `/tmp/opencode/beta2-npm-acceptance.json`.
+
+## Installed update verified
+
+The website command `npm install -g carthagent@next` installed beta.2 into an
+isolated Linux x64 home/prefix. Default runtime acquisition resolved the pinned
+CTG-owned executable with SHA-256
+`8a34735274c0b62049f6ae882dc955016fde54458efc18822fbcedb2e8eddeda`.
+The beta update check reported the installed version as current.
+Evidence: `/tmp/opencode/beta2-clean-install-acceptance.json`.
+
+An isolated npm installation of beta.1 detected beta.2 with
+`ctg update --channel beta --check`. Running `ctg update --channel beta` upgraded
+it to beta.2; a profile sentinel remained byte-for-byte intact. This used a
+disposable home and global npm prefix, not the user's normal installation.
+Evidence: `/tmp/opencode/beta2-update-acceptance.json`.
+
+## Remaining acceptance
+
+Stripe sandbox access subsequently became available. Real purchases, upgrades,
+SCA, renewal, failed renewal and cancellation were exercised separately against
+the isolated backend (see backend `docs/stripe-sandbox-acceptance.md`).
+
+An isolated published beta.2 login connected the authorized existing Cloud account.
+A real range-fix task passed four independent tests. Continuing that same session
+hit its persistent elapsed-time budget; beta.2 showed only an unexplained interrupt.
+The follow-up source fix adds actionable budget diagnostics and explicit
+`--reset-budget` support. With that source launcher and the same installed runtime,
+profile and session, continuation added an ascending-across-zero regression and
+passed all five independent tests. This launcher fix is not part of immutable beta.2.
+Execution budgets are not billing credit and never reset on payment or ordinary
+continuation. Evidence: `/tmp/opencode/stripe-acceptance/live-continuation-fixed.log`.
+
+Full task continuation across a genuine payment boundary remains incomplete:
+the real model task used existing Cloud credit and sandbox payments used a separate
+backend without a model upstream. Screenshot approval is not claimed. Local terminal timing failures
+were followed by passing full local, CI and draft acceptance; this does not prove
+that every terminal timing issue is resolved.
+
+The normal installed profile and Invest-With-Friends files were not changed by
+these release checks. Stable npm `latest` remains 1.0.7.

package/docs/beta3-published-acceptance.md

@@ -0,0 +1,75 @@
+# Beta.3 release acceptance
+
+November 2, 2026. Immutable tag `v1.1.0-beta.3` resolves to
+`ee2fa3f039c296aa4ca613c474eb460e27a23ff2`. Release PR #243 merged at
+`0964ce7331eb749183131d6031823137d068afa9`, preserving tag ancestry.
+
+## Verified release gates
+
+- Five-platform prebuild [41537249365](https://github.com/B-icy/Carthagent/actions/runs/41537249365)
+  passed from reviewed main `c11103f8b57c6b3254473a78d535a404bea9a84a`.
+  Local regeneration verified archive/executable hashes and embedded provenance;
+  the candidate, packaged and uploaded manifests match exactly.
+- Local quality passed lint/build and 1,132 tests, five skipped. An initial run
+  before candidate installation correctly rejected the temporary package/manifest
+  version mismatch.
+- PR CI [41539253388](https://github.com/B-icy/Carthagent/actions/runs/41539253388)
+  passed on attempt 2 across Linux, macOS and Windows, browser and package gates.
+  Initial failed jobs ran before draft asset uploads completed.
+- Local installed-package acceptance passed all 28 probes/scenarios with the
+  default isolated acquisition path. Earlier local acquisition attempts used an
+  unsupported `gh auth token` command; the acceptance shell was corrected to use
+  this older CLI's supported credential lookup. No product workaround was used.
+- Final draft acceptance [41541394653](https://github.com/B-icy/Carthagent/actions/runs/41541394653)
+  passed against the immutable tag, assets and main ancestry.
+- The GitHub prerelease is public. Anonymous downloads of all five archives
+  matched the packaged checksums.
+- Release workflow [41542206810](https://github.com/B-icy/Carthagent/actions/runs/41542206810)
+  passed anonymous installed-package acceptance and reported npm publication
+  with signed provenance (transparency log index 3652108243).
+
+## Public npm availability
+
+The first public exact-version requests returned 404 after the workflow reported
+successful publication. Registry visibility subsequently converged without repeat
+publication. Verified tags are `next=1.1.0-beta.3`, `latest=1.0.7`.
+
+The public tarball's SHA-512 matches npm integrity and the provenance subject.
+Sigstore verification passed for the GitHub Actions issuer and repository
+`release.yml@refs/heads/main` identity. The statement identifies workflow
+41542206810; package `gitHead` equals the immutable tag. Private receipt:
+`/tmp/opencode/beta3-npm-acceptance.json`.
+
+## Public install and update
+
+`npm install -g carthagent@next` installed beta.3 into a disposable Linux x64
+profile. A separate beta.2 installation detected and upgraded to beta.3 using
+`ctg update --channel beta`. Both acquired the CTG-owned runtime with executable
+SHA-256 `f9ad13d8aad76bf1d16334712f0060b886757f5cdabddacce42f9805d4482c1c`,
+preserved profile sentinels, displayed `--reset-budget` and billing-refresh help,
+and reported beta.3 as current. Private receipt:
+`/tmp/opencode/beta3-public-acceptance/evidence.json`.
+
+The continuation-budget regression passed when run from the publicly installed
+package: exhausted continuation reports the reason, ordinary continuation does
+not reset/retry, and explicit reset targets the same session before prompting.
+This is an offline regression, not another real-model/payment journey.
+
+The first public-install script used an overly literal help assertion expecting
+`billing refresh`; actual help correctly lists `billing [checkout|portal|refresh]`.
+The assertion was corrected and both complete install/update scenarios passed.
+
+## Journey evidence and boundary
+
+Backend PRs #180–181 are deployed. Fresh sandbox evidence covers automatic
+partial-refund revocation, initial and upgrade 3DS2, declined-upgrade recovery on
+the same invoice and preserved renewal anchors. Scheduled cancellation retains
+paid access and displays the end date accurately. Backend PR #182 records these
+results in `docs/stripe-sandbox-acceptance.md`.
+
+The real production Cloud task and exact-session continuation with the source
+launcher passed five independent project tests. A single task crossing a real
+payment boundary remains unverified: model execution used production credit,
+while payments used the isolated sandbox without a model upstream.
+
+Normal installed profile and Invest-With-Friends work were preserved.

package/docs/cloud-fresh-install-acceptance.md

@@ -0,0 +1,135 @@
+# Cloud fresh-install acceptance (in progress)
+
+## Public installed baseline
+
+On November 3, 2026, the normal global `carthagent@1.1.0-beta.2` installation
+was uninstalled. Absence of `ctg` on PATH was verified, then
+`npm install -g carthagent@next` installed public `1.1.0-beta.3`.
+
+The normal profile was moved out before installation. A real tmux terminal
+running bare `ctg` showed no selected provider and only a generic connection
+action. `/login` put Cloud under Services, after OpenAI, Anthropic and Gemini.
+
+## Restart and backup incident
+
+The original profile was moved to a private directory under `/tmp/opencode`,
+which was erased during the harness/server restart. This was an inadequate
+backup location. The original normal profile has not been recovered. The
+Invest-With-Friends workspace and its `.harness` directory still exist; they
+were not moved or edited by the reinstall. Separate older native test profiles
+survive but are not replacements for the lost normal profile.
+
+Subsequent acceptance state is stored in a private durable directory under
+`~/.local/share/carthagent-acceptance/`. The public beta installation and source
+changes survived. The old isolated payment sandbox, local receipts and disposable
+task under `/tmp/opencode` did not. Previously committed acceptance documents
+remain the record of those earlier runs.
+
+## Candidate changes
+
+- Home names Carthagent Cloud and offers direct sign-in when no model is selected.
+- The connection picker lists Cloud first, under Recommended.
+- `/login` targets Cloud; `/connect` retains the provider picker.
+- Terminal `ctg login` accepts Enter for its displayed recommended default.
+
+## Candidate validation
+
+The Linux candidate was compiled from pinned upstream source
+`843a6c514e606b436a7fe713422ace0a93ad3d61` and combined-v6 patch
+`31e15c7f92f82177bf1b6106732926951c4d751bde36b61f3e1e283818ea5631`.
+Its executable SHA-256 is
+`c35f0d340b9f38e30daf5ad78c945e46e90b1d2470241033cdd4e7b8271aa346`.
+The patch applies cleanly to the pinned upstream tree.
+
+Real tmux launches at 110 and 60 columns visibly show the Cloud action.
+`/login` goes directly to Cloud device authorization. `/connect` lists Cloud
+first under Recommended. Terminal `ctg login` lists Cloud first and pressing
+Enter starts its authorization. Email authorization completed and the model
+became available without manual provider configuration.
+
+The runtime TUI typecheck, 11 integration-dialog tests, two narrow/wide
+onboarding render tests, native plugin typecheck and launcher tests pass.
+The full quality gate passes with 1,133 tests passing and five skipped, including
+the additional headless-continuation fixes. The focused CLI/provider suite passes
+59/59, including foreign-workspace rejection before a headless model switch.
+
+## Combined real-model / Stripe-test journey
+
+The durable isolated backend uses the real Cloud control plane, gateway and
+ledger, a real OpenRouter model upstream, and Stripe test-mode Checkout and
+signed webhooks. This is not production-upstream acceptance. Neither prices
+nor usage consumption were mocked to cross the payment boundary.
+
+Session `ses_e60d2dab0ffe6wz3L7236pcXer` started a Node.js streaming CSV expense
+report CLI task. Eleven real Sonnet requests consumed $0.664548 of its $1
+starter grant. A subsequent request received `provider.quota` / HTTP 429:
+the remaining $0.335452 could not cover its required reservation. Nine files,
+including source, tests and delivery evidence, were preserved and hashed.
+
+Builder Checkout displayed $1 due today, then $10/month. One test-card payment
+completed and signed `checkout.session.completed` and `invoice.paid` events
+activated Builder. The task remained idle, all nine hashes stayed identical,
+and request count remained 11 until explicit continuation after `billing refresh`.
+The same session then made new real model calls using paid allowance.
+
+Sonnet hit Builder's $0.50 daily reservation limit, so the same test subscription
+was upgraded to Max through the ordinary confirmation page. The $49 prorated
+test charge activated Max, retained the December 3 renewal date and preserved
+consumption. Sonnet later hit Max's reservation ceiling too; a lower-cost real
+DeepSeek V3.2 model was added to the sandbox to finish the existing task without
+altering allowances or resetting consumed usage.
+
+This uncovered two launcher defects addressed in this branch:
+
+- Explicit headless `--session ... --model ...` must switch the existing
+  session model before submitting the continuation, just as the TUI path does.
+- A fixed two-minute transport observation timeout interrupted useful tasks
+  despite a larger session execution budget. The launcher now allows at least
+  30 minutes of observation, extending it for a larger explicit time budget.
+  Persistent host execution budgets still apply; `--reset-budget` is explicit.
+
+## Task result and remaining acceptance
+
+PR #245 merged as `521675b77f156461ed829ef328d892f78797604c` after all Linux,
+macOS and Windows Node 22/24 checks, native-package, native-navigation and
+browser checks passed. The release candidate prebuild selects combined-v6;
+the public package remains beta.3 until publication.
+
+Beta.4 prebuild run `41569547389` succeeded from reviewed source
+`67035d0758321901ef56a71c3a8e7561274dfd38`. All five downloaded archives and
+embedded executable hashes passed independent local acquisition verification.
+The final package manifest uses those exact candidate hashes and combined-v6.
+The Linux release executable SHA-256 is
+`9f998cb2d23e2c18258a5bcb9a9588228e6fef9f089b13bb2f74b80d8ee8d7f6`;
+it differs from the earlier locally compiled candidate recorded above.
+
+The same task implemented parser, validator, aggregator, exporter and CLI
+source, with 78 self-authored tests passing during continuation. Independent
+probes found defects: invalid sign-only money accepted, unsafe integer cents,
+incorrect record line numbers, split UTF-8/BOM corruption, malformed quote
+acceptance, cross-currency summary totals, nondeterministic timestamps, and
+missing CSV field quoting. CLI tests, fixtures and README were unfinished.
+**The expense task is not accepted as complete.** These findings were submitted
+to the same session for repair, rather than silently fixed outside the task.
+
+Further continuation encountered tunnel 502s and the local Node 26 upstream
+HTTP/2 pool's `ERR_HTTP2_INVALID_SESSION`. The sandbox switched to HTTP/1.1
+and direct localhost access to the same Cloud backend. Unknown-outcome requests
+retained their reservations. At the recorded checkpoint, paid consumption was
+$3.120214780 and outstanding reservations $0.819894980 against the $4 daily
+limit; five requests required reconciliation. No reservations or consumed usage
+were erased. Reducing the model's request envelope was also tried and reverted:
+the gateway cap counts request bytes, and the smaller envelope rejected this
+existing conversation. Full task completion remains blocked.
+
+Durable private receipts include `task-interim-result.json`, file hashes,
+signed payment event IDs and `independent-audit.md`. The evidence establishes
+fresh sign-in, genuine quota rejection, Stripe-test activation, no automatic
+restart, and explicit real-model paid continuation on the exact same session.
+It does not establish independently verified task success or production
+inference acceptance.
+
+The normal installation remains public beta.3, reauthenticated to the production
+test account. Its prior local session history and settings have not been recovered.
+An additional backup search found production Voyages backups, which are unrelated
+to the lost local profile.

package/docs/cloud-onboarding-acceptance.md

@@ -1,7 +1,10 @@
-# Cloud onboarding — unreleased implementation
+# Cloud onboarding — beta.2 implementation
 
-November 2, 2026. This branch is not published beta acceptance. npm `next` remains
-1.1.0-beta.1 and `latest` remains 1.0.7.
+November 2, 2026. Beta.2 is published on GitHub and npm `next`; `latest` remains
+1.0.7. See [published acceptance](beta2-published-acceptance.md) for final CI,
+draft/public runtime gates, signed npm provenance, Linux clean installation and
+isolated beta.1 → beta.2 update evidence. Historical preparation notes below do
+not supersede that release record.
 
 Native PR #238 merged at `a5ad2164d056fee7f7183579ce6cc97305bae53b` after CI
 41504674623 passed. First-task guidance is tracked in PR #239. Beta.2 runtime