carthagent 1.1.0-beta.3 → 1.1.0-beta.4

package/docs/beta3-published-acceptance.md

@@ -0,0 +1,75 @@
+# Beta.3 release acceptance
+
+November 2, 2026. Immutable tag `v1.1.0-beta.3` resolves to
+`ee2fa3f039c296aa4ca613c474eb460e27a23ff2`. Release PR #243 merged at
+`0964ce7331eb749183131d6031823137d068afa9`, preserving tag ancestry.
+
+## Verified release gates
+
+- Five-platform prebuild [41537249365](https://github.com/B-icy/Carthagent/actions/runs/41537249365)
+  passed from reviewed main `c11103f8b57c6b3254473a78d535a404bea9a84a`.
+  Local regeneration verified archive/executable hashes and embedded provenance;
+  the candidate, packaged and uploaded manifests match exactly.
+- Local quality passed lint/build and 1,132 tests, five skipped. An initial run
+  before candidate installation correctly rejected the temporary package/manifest
+  version mismatch.
+- PR CI [41539253388](https://github.com/B-icy/Carthagent/actions/runs/41539253388)
+  passed on attempt 2 across Linux, macOS and Windows, browser and package gates.
+  Initial failed jobs ran before draft asset uploads completed.
+- Local installed-package acceptance passed all 28 probes/scenarios with the
+  default isolated acquisition path. Earlier local acquisition attempts used an
+  unsupported `gh auth token` command; the acceptance shell was corrected to use
+  this older CLI's supported credential lookup. No product workaround was used.
+- Final draft acceptance [41541394653](https://github.com/B-icy/Carthagent/actions/runs/41541394653)
+  passed against the immutable tag, assets and main ancestry.
+- The GitHub prerelease is public. Anonymous downloads of all five archives
+  matched the packaged checksums.
+- Release workflow [41542206810](https://github.com/B-icy/Carthagent/actions/runs/41542206810)
+  passed anonymous installed-package acceptance and reported npm publication
+  with signed provenance (transparency log index 3652108243).
+
+## Public npm availability
+
+The first public exact-version requests returned 404 after the workflow reported
+successful publication. Registry visibility subsequently converged without repeat
+publication. Verified tags are `next=1.1.0-beta.3`, `latest=1.0.7`.
+
+The public tarball's SHA-512 matches npm integrity and the provenance subject.
+Sigstore verification passed for the GitHub Actions issuer and repository
+`release.yml@refs/heads/main` identity. The statement identifies workflow
+41542206810; package `gitHead` equals the immutable tag. Private receipt:
+`/tmp/opencode/beta3-npm-acceptance.json`.
+
+## Public install and update
+
+`npm install -g carthagent@next` installed beta.3 into a disposable Linux x64
+profile. A separate beta.2 installation detected and upgraded to beta.3 using
+`ctg update --channel beta`. Both acquired the CTG-owned runtime with executable
+SHA-256 `f9ad13d8aad76bf1d16334712f0060b886757f5cdabddacce42f9805d4482c1c`,
+preserved profile sentinels, displayed `--reset-budget` and billing-refresh help,
+and reported beta.3 as current. Private receipt:
+`/tmp/opencode/beta3-public-acceptance/evidence.json`.
+
+The continuation-budget regression passed when run from the publicly installed
+package: exhausted continuation reports the reason, ordinary continuation does
+not reset/retry, and explicit reset targets the same session before prompting.
+This is an offline regression, not another real-model/payment journey.
+
+The first public-install script used an overly literal help assertion expecting
+`billing refresh`; actual help correctly lists `billing [checkout|portal|refresh]`.
+The assertion was corrected and both complete install/update scenarios passed.
+
+## Journey evidence and boundary
+
+Backend PRs #180–181 are deployed. Fresh sandbox evidence covers automatic
+partial-refund revocation, initial and upgrade 3DS2, declined-upgrade recovery on
+the same invoice and preserved renewal anchors. Scheduled cancellation retains
+paid access and displays the end date accurately. Backend PR #182 records these
+results in `docs/stripe-sandbox-acceptance.md`.
+
+The real production Cloud task and exact-session continuation with the source
+launcher passed five independent project tests. A single task crossing a real
+payment boundary remains unverified: model execution used production credit,
+while payments used the isolated sandbox without a model upstream.
+
+Normal installed profile and Invest-With-Friends work were preserved.

package/docs/cloud-fresh-install-acceptance.md

@@ -0,0 +1,135 @@
+# Cloud fresh-install acceptance (in progress)
+
+## Public installed baseline
+
+On November 3, 2026, the normal global `carthagent@1.1.0-beta.2` installation
+was uninstalled. Absence of `ctg` on PATH was verified, then
+`npm install -g carthagent@next` installed public `1.1.0-beta.3`.
+
+The normal profile was moved out before installation. A real tmux terminal
+running bare `ctg` showed no selected provider and only a generic connection
+action. `/login` put Cloud under Services, after OpenAI, Anthropic and Gemini.
+
+## Restart and backup incident
+
+The original profile was moved to a private directory under `/tmp/opencode`,
+which was erased during the harness/server restart. This was an inadequate
+backup location. The original normal profile has not been recovered. The
+Invest-With-Friends workspace and its `.harness` directory still exist; they
+were not moved or edited by the reinstall. Separate older native test profiles
+survive but are not replacements for the lost normal profile.
+
+Subsequent acceptance state is stored in a private durable directory under
+`~/.local/share/carthagent-acceptance/`. The public beta installation and source
+changes survived. The old isolated payment sandbox, local receipts and disposable
+task under `/tmp/opencode` did not. Previously committed acceptance documents
+remain the record of those earlier runs.
+
+## Candidate changes
+
+- Home names Carthagent Cloud and offers direct sign-in when no model is selected.
+- The connection picker lists Cloud first, under Recommended.
+- `/login` targets Cloud; `/connect` retains the provider picker.
+- Terminal `ctg login` accepts Enter for its displayed recommended default.
+
+## Candidate validation
+
+The Linux candidate was compiled from pinned upstream source
+`843a6c514e606b436a7fe713422ace0a93ad3d61` and combined-v6 patch
+`31e15c7f92f82177bf1b6106732926951c4d751bde36b61f3e1e283818ea5631`.
+Its executable SHA-256 is
+`c35f0d340b9f38e30daf5ad78c945e46e90b1d2470241033cdd4e7b8271aa346`.
+The patch applies cleanly to the pinned upstream tree.
+
+Real tmux launches at 110 and 60 columns visibly show the Cloud action.
+`/login` goes directly to Cloud device authorization. `/connect` lists Cloud
+first under Recommended. Terminal `ctg login` lists Cloud first and pressing
+Enter starts its authorization. Email authorization completed and the model
+became available without manual provider configuration.
+
+The runtime TUI typecheck, 11 integration-dialog tests, two narrow/wide
+onboarding render tests, native plugin typecheck and launcher tests pass.
+The full quality gate passes with 1,133 tests passing and five skipped, including
+the additional headless-continuation fixes. The focused CLI/provider suite passes
+59/59, including foreign-workspace rejection before a headless model switch.
+
+## Combined real-model / Stripe-test journey
+
+The durable isolated backend uses the real Cloud control plane, gateway and
+ledger, a real OpenRouter model upstream, and Stripe test-mode Checkout and
+signed webhooks. This is not production-upstream acceptance. Neither prices
+nor usage consumption were mocked to cross the payment boundary.
+
+Session `ses_e60d2dab0ffe6wz3L7236pcXer` started a Node.js streaming CSV expense
+report CLI task. Eleven real Sonnet requests consumed $0.664548 of its $1
+starter grant. A subsequent request received `provider.quota` / HTTP 429:
+the remaining $0.335452 could not cover its required reservation. Nine files,
+including source, tests and delivery evidence, were preserved and hashed.
+
+Builder Checkout displayed $1 due today, then $10/month. One test-card payment
+completed and signed `checkout.session.completed` and `invoice.paid` events
+activated Builder. The task remained idle, all nine hashes stayed identical,
+and request count remained 11 until explicit continuation after `billing refresh`.
+The same session then made new real model calls using paid allowance.
+
+Sonnet hit Builder's $0.50 daily reservation limit, so the same test subscription
+was upgraded to Max through the ordinary confirmation page. The $49 prorated
+test charge activated Max, retained the December 3 renewal date and preserved
+consumption. Sonnet later hit Max's reservation ceiling too; a lower-cost real
+DeepSeek V3.2 model was added to the sandbox to finish the existing task without
+altering allowances or resetting consumed usage.
+
+This uncovered two launcher defects addressed in this branch:
+
+- Explicit headless `--session ... --model ...` must switch the existing
+  session model before submitting the continuation, just as the TUI path does.
+- A fixed two-minute transport observation timeout interrupted useful tasks
+  despite a larger session execution budget. The launcher now allows at least
+  30 minutes of observation, extending it for a larger explicit time budget.
+  Persistent host execution budgets still apply; `--reset-budget` is explicit.
+
+## Task result and remaining acceptance
+
+PR #245 merged as `521675b77f156461ed829ef328d892f78797604c` after all Linux,
+macOS and Windows Node 22/24 checks, native-package, native-navigation and
+browser checks passed. The release candidate prebuild selects combined-v6;
+the public package remains beta.3 until publication.
+
+Beta.4 prebuild run `41569547389` succeeded from reviewed source
+`67035d0758321901ef56a71c3a8e7561274dfd38`. All five downloaded archives and
+embedded executable hashes passed independent local acquisition verification.
+The final package manifest uses those exact candidate hashes and combined-v6.
+The Linux release executable SHA-256 is
+`9f998cb2d23e2c18258a5bcb9a9588228e6fef9f089b13bb2f74b80d8ee8d7f6`;
+it differs from the earlier locally compiled candidate recorded above.
+
+The same task implemented parser, validator, aggregator, exporter and CLI
+source, with 78 self-authored tests passing during continuation. Independent
+probes found defects: invalid sign-only money accepted, unsafe integer cents,
+incorrect record line numbers, split UTF-8/BOM corruption, malformed quote
+acceptance, cross-currency summary totals, nondeterministic timestamps, and
+missing CSV field quoting. CLI tests, fixtures and README were unfinished.
+**The expense task is not accepted as complete.** These findings were submitted
+to the same session for repair, rather than silently fixed outside the task.
+
+Further continuation encountered tunnel 502s and the local Node 26 upstream
+HTTP/2 pool's `ERR_HTTP2_INVALID_SESSION`. The sandbox switched to HTTP/1.1
+and direct localhost access to the same Cloud backend. Unknown-outcome requests
+retained their reservations. At the recorded checkpoint, paid consumption was
+$3.120214780 and outstanding reservations $0.819894980 against the $4 daily
+limit; five requests required reconciliation. No reservations or consumed usage
+were erased. Reducing the model's request envelope was also tried and reverted:
+the gateway cap counts request bytes, and the smaller envelope rejected this
+existing conversation. Full task completion remains blocked.
+
+Durable private receipts include `task-interim-result.json`, file hashes,
+signed payment event IDs and `independent-audit.md`. The evidence establishes
+fresh sign-in, genuine quota rejection, Stripe-test activation, no automatic
+restart, and explicit real-model paid continuation on the exact same session.
+It does not establish independently verified task success or production
+inference acceptance.
+
+The normal installation remains public beta.3, reauthenticated to the production
+test account. Its prior local session history and settings have not been recovered.
+An additional backup search found production Voyages backups, which are unrelated
+to the lost local profile.