buzz/beehive/CHECKPOINT.md

Claude 6f8d — final executable / partial delivery

Strict TypeScript PASS. Exactly ONE FULL DEFAULT concurrent installed-enabled suite: 86/86 PASS, zero skips/failures/cancellations, natural 87.493s on Node24.15.0/pnpm11.4.0. No serial mask, timeout change, forced exit, assertion weakening or full-suite retry. All four reused normal wizard/host-CLI/TUI journeys (Goose and Claude initial/selected-B) passed; Claude adds six owned ACP/private-env cases. Final strict initially stopped before any full run on a test union-field narrowing error; that log survives as strict-3-union-narrowing-failed.log. Corrected with a typeof guard, not a cast/relaxed test. Earlier strict errors remain in logs.

Delivered: bounded Claude API-key first-class choice through existing initial normal/diagnostic wizard and immutable add-claude binding, local service HOME/env, canonical CLI/adapter/key prerequisites, actual same-session model report before prompts, package-gated native profile, explicit fresh Restart. Existing reusable keys/bindings/assignment authority, profiles, sibling/history and fixed host control identity/relay/trust retained. Wrong-model/native-capability/auth failure preserves actual; missing local API key still allows Stop. No source or binary substitution.

Not delivered: Codex, Claude subscription/Bedrock/Vertex/provider variants, Claude native optional settings/resume/load; those are explicit fail-closed gaps, not silently downgraded paths. Broader providers/presets/custom/mesh/compute, production/current-kind40002 admission and real service-user login remain. New Claude-specific hidden-standby/key-removal wizard matrices are not independently repeated; unchanged generic authority/hidden-import/missing-agent-key tests pass. No real Claude/Goose/provider login or inference, no full-product approval.

REAL binaries (fresh SHA256, unchanged): buzz-acp 10612d0025d1420bdd9e9afcc2e7129377da2414e75049a8b640e81d857441ea; Buzz CLI 147cc2ccf276ddedc5b84d13f5399a95282066303c9dca566bb2af5a37b856c5. Claude adapter is a deterministic source-shaped TS fixture; vendor CLI is Node placeholder (no login/status execution). Four real signed replies per Claude journey, same identity, exact native profile/model/fresh session, public-inventory privacy assertions and owned process absence. No stronger provider attestation.

Self-review inspected source shapes, private env allowlist, no BUZZ_ACP_MODEL dual Claude authority, local credential error redaction, vendor CLI hash in prepared inputs, immutable manifests/common pins, broker model-before-prompt and existing cancellation/optional-config semantics. Existing trusted-operator TOCTOU/POSIX in-group containment limits persist. Historical 71/73 failures remain unclassified; NORMAL_REVIEW_425FEB34 is CLOSED, no new independent review claimed for this delta.

Source citations: CLAUDE_SOURCE_6F8D.md. Logs and source/binary hashes: /Users/loganj/.buzz/WORK_LOGS/BEEHIVE_DESIGN_183FFAF0/CLAUDE_6F8D/. Configured Logan Johnson loganj@squareup.com + DCO, no cryptographic signer or persistent configuration edits. Exact publication head is in terminal result and that directory's publication record. No owner stores/provider/production/Rust/native/ client changes, repo-wide or GitHub CI, merge/release/PR claim.

Next executable work: implement Codex's separate local auth/config/model/native profile-capability contract, not a Claude/Goose relabel, then reuse the same actual normal/selected-binding installed journeys. Claude's unimplemented auth/settings modes need separate source-grounded acceptance, not a universal credentials form.

Recovery 5360 — final validation / publication candidate

Recovered base HEAD: 425feb343e. The source candidate is the commit containing this section; all surviving predecessor edits were preserved and completed, not reset or duplicated.

Explicit relay-review R1: CLOSED. CLI consumes relay close callback, drains queued persistence, surfaces sanitized possible durability uncertainty and exits 1; actual subprocess directory-fault (wire1011 + possible replacement) and clean SIGINT exit0 controls pass. No storage-fence/uncertain-vs-rejected change.

Final strict PASS; exactly ONE FULL DEFAULT concurrent installed-enabled suite 78/78, zero skips/cancellations, natural 44.186s, on Node 24.15.0/pnpm 11.4.0. Both host CLI service journeys, pre-ready SIGINT/SIGTERM and policy driver pass. No serial mask, retry-to-green, timeout increase, force exit or weak assertions. No executable edits after this run; only acceptance documentation. The prior 71/73 broker/reply-tool failures and older disconnect/admission observations remain separately scoped, not classified by nonrecurrence. Historical broker/tool diagnosis remains unclassified. NORMAL_REVIEW_425FEB34 is independently CLOSED: 6/6 recovered plus fresh strict/authority negatives; not a pending normal-transition review.

Self-review: one natural host close promise owns startup abort and ready shutdown; all slots drain with allSettled, uncertain teardown retains lock, and CLI awaits errors. No PID-derived cleanup authority. Policy barrier is public inventory for exact host/agent/revision, not sleep or operation retry; product CAS unchanged. Recovered service test uses actual CLI from wizard installation, never direct host construction. Captured child output is capped at 8192 characters. Evidence directory: WORK_LOGS/BEEHIVE_DESIGN_183FFAF0/RECOVERY_5360, including final-strict.log, full-installed-default.log and separate source/installed hashes. Installed pins unchanged (buzz-acp 10612d00…441ea; Buzz CLI 147cc2cc…766bb2af5a37b856c5). Configured Logan Johnson loganj@squareup.com author/committer + DCO; no invented cryptographic signer. Publication verification recorded in that evidence directory.

Remaining: independent findings reconciliation, actual Goose/provider login and production service/current kind40002 admission; Claude/Codex/providers/presets/ custom/mesh/compute and full parity. Installed Goose is a deterministic TS fixture, not real Goose or live LLM proof. No owner credentials, OAuth caches, private run journals, provider calls, production operations, Rust/native/client changes, repo CI, merge, release or full-product claim.

Recovery 5360 — pre-final exact candidate gate

R1 CLOSED locally: actual CLI fault/clean SIGINT 2/2 + strict on pinned Node 24.15.0/pnpm 11.4.0. Startup/policy focused 8/8 (5.349s): actual SIGINT/SIGTERM before withheld upgrade ready releases clean lock, unchanged journal, subsequent startup/ready shutdown; quarantine keeps lock and double close shares teardown. No reconnect/deadline changes. Policy driver now waits for relevant PUBLIC host+agent running inventory rev1 before spawning Stop TUI. This source-grounded bounded barrier preserves all CAS/unknown/retry/operation-count assertions; pinned runtime reproduces accepted unchanged original Stop at rev2 in both loss modes. Not a product recovery fix. Recovered service subprocess journeys PASS 2/2 (38.142s): wizard-produced initial normal and selected-B NEW immutable conversion, actual host CLI subprocess, installed buzz-acp/Buzz CLI, four signed same-agent replies including Restart, model/profile/history/Y assertions. Goose is still a TS protocol fixture, no live provider/current-kind40002 admission or production service deployment. Bounded recovered test stdout/stderr tails to 8 KiB. Evidence RECOVERY_5360/ {r1,startup-policy,service}.log; older CLI_333D partial log retained unchanged. Next: strict + ONE FULL DEFAULT concurrent installed-enabled run of this exact executable candidate, no serial masking/retries/deadline increase/force exit. Historical full 71/73 and older failures remain separately scoped.

Recovery 5360 — preserved working state, before validation

Recovered HEAD 425feb343e07f5d36fb7ee18b9502c0fd172b15d; no new commits. Preserved prior edits to cli.ts, host.ts, normal-conversation/startup-transport tests, and untracked cli-shutdown.test.ts / relay-cli-fault.ts. No reset/cleanup. R1 patch already present (callback diagnostic/nonzero exit); prior local 2/2 claim retained below, fresh pinned validation pending. Startup abort and actual service journey edits also survived; not yet accepted. Policy public-inventory driver fix was absent and is next after R1 validation. Evidence: CLI_333D existing public logs; new evidence will be in RECOVERY_5360. No private run journals consulted.

CLI lifecycle continuation 333d — early R1 checkpoint

425feb actual CLI still discarded relay.close errors: R1 was OPEN, not fixed by normal wizard work. Now the real CLI consumes close callback, reports sanitized possible durability uncertainty, exits 1, and leaves history/fences intact. Clean SIGINT exits 0. Actual CLI subprocess regressions (test-only module load injection at existing directory boundary, no copied CLI) pass 2/2, strict passes on Node 24.15.0/pnpm 11.4.0. Replacement present + wire1011 is NOT durable rejection or accepted data loss. R1 implementation/regression CLOSED locally; final gate and publication pending. Startup signals and service subprocess work follow.

Beehive executable checkpoint

Normal conversation wizard A661 — final gate / scoped handoff

Final exact executable: strict PASS; ONE FULL DEFAULT concurrent installed-enabled suite 71/73, zero skips/cancellations, natural 46.738s. All new conversion, normal hidden standby PTY and both installed normal/selected-B Start+Restart journeys passed. Two unchanged failures: broker.test.ts:31 (assert.ok('value' in r)), and reply-tool.test.ts:64 (successful descendant spawn required). Causes remain unclassified. No repeat, serial mask, timeout inflation, force-exit, assertion weakening or containment code change. Historical policy-TUI and disconnect passed this run, not retrospective classification/closure of their earlier observations.

Logs final-strict.log, full-installed-default.log, focused iteration logs and separate source/binary attribution retained in NORMAL_A661/. Installed hashes still match retained pins. Focused-1 passed 3/3; focused-2 failed 0/2 at the incorrect Goose turn-prompt assertion described below; corrected focused-3 passed 2/2; focused-4 passed conversion/bindings/Goose (see exact log). Final gate does not claim full engineering acceptance. Publication uses configured Logan Johnson + DCO; exact commit/remote verification is in the terminal/publication record.

ONE next parity step: independently review this immutable common-authority/new-ref transition and reconcile the two bounded full-gate failures without rerun-to-green, then extend service-subprocess/live Goose/provider and remaining harness parity. Installed host function and runtime/CLI subprocess proof is not production service HOME/login/current-kind40002 admission proof. Claude/Codex/providers/presets/custom/ mesh/compute/startup-signal cleanup remain explicit, no full product/release claim.

Implementation decision and focused evidence

Base published 58c566bbce. Normal initial setup is now the default for ACP harnesses; explicit diagnostic mode remains. Existing selected B converts to a NEW immutable normal reference under host.lock with all slots stopped, retained authority/key and source fingerprint revalidation. ONE manifest rename pins common authority and activates the new definition; no journal or selected-next rewrite, so remote Save retains public CAS. Old A/B/history/Y/keys are untouched. Normal snapshots must equal pinned common runtime/relay/tool/trust; diagnostic opt-out is per binding. Legacy in-place conversation-setup is refused. Existing normal authority is reused without new auth input or silent widening.

Focused installed initial + selected-B journeys passed 2/2: real CLI/TUI, production host() in-process, installed buzz-acp/Buzz CLI, native-shaped Goose fixture, three same-agent signed cross-channel/later replies plus fresh Restart reply/session and exact native profile/model. Wrong-model preflight preserves actual; replay/Stop cannot revive it. Separate focused conversion/bindings/Goose suite passed, including normal hidden standby import PTY, lock/stale/active/authority/decline controls. Evidence: workspace WORK_LOGS/BEEHIVE_DESIGN_183FFAF0/NORMAL_A661/. One test-authoring iteration failed both installed tests: profile was incorrectly expected inside Goose turn prompt instead of native system-prompt extension. The assertion now binds that actual extension output (same retained installed Goose owner seam); no product change, timing relaxation or historical failure closure. Initial discovery scan timed out; python alias absent, reran edit with python3.

Self-review: common authority migration/fallback, immutable snapshots/fingerprints, manifest activation crash coherence, lock ownership, source revalidation, selected inventory vs actual evidence, no new runtime/env/remote credentials, initial key creation/import owner unchanged. No provider/Goose executable/OAuth/current40002 proof. No full product, repo CI, startup-signal cleanup or historical policy-timing classification. ONE final strict + FULL DEFAULT concurrent installed-enabled gate is next; no rerun-to-green, serial mode, deadline change or assertion weakening.

Continuation 0346 — bounded disconnect investigation / partial UX increment

Final validation: strict passes; one FULL DEFAULT concurrent installed-enabled run 69/70, zero skips/cancellations, natural 32.943s. Disconnect passed with handler-installed 51ms before disconnect, callback entry 27ms after disconnect, TERM write complete 59ms after disconnect, group absence observed 522ms after disconnect (diagnostic wall-clock deltas, not timing guarantees). No missing TERM recurrence; historical cause remains unclassified. Existing installed Buzz Agent/Goose conversation and installed Move tests passed. Sole failure unchanged policy-tui.test.ts:122: expected blocked Stop at revision 1, actual durable operation/output says revision 0. Cause not investigated in this bounded increment; full engineering gate remains OPEN. No repeat-to-green. Logs and separate source/ binary hashes: workspace WORK_LOGS/BEEHIVE_DESIGN_183FFAF0/CONTINUATION_0346/. Self-review: only capped fresh-fixture diagnostics and completion guidance; original TERM/group absence assertions retained, no runtime/relay/auth/assignment changes. Normal wizard conversion and installed selected-B Start/Restart are NOT delivered.

Starting clean e8f9543ce4. Source inspection: orphan-fixture.ts installs SIGTERM before resistant.ready; disconnect already waits for that marker after spawnOwned.ready. The latter proves OS runner spawn, not script readiness, but this test does not rely solely on it. Fresh cwd exists before spawn; TERM writes synchronously there; cleanup follows assertions. Thus no missing handler-readiness gate is established. Historical ENOENT remains unclassified: scheduling/callback delivery, self-expiry or write failure were not recorded. Production owned/supervisor/relay code and original deadlines unchanged. Fixture now retains capped lifecycle timestamps/PID/cwd, TERM callback/write/error and self-expiry events; disconnect includes them in failure output before cleanup. Positive PID, group absence and TERM marker assertions remain. One focused probe and final strict/default installed-enabled gate will be recorded below, not used to retrospectively classify the historical failure.

Small UX correction: initial Goose now receives the same honest ACP-probe-only completion warning as Buzz Agent, naming explicit conversation-setup and local service/runtime/tool/admission prerequisites. Actual CLI test asserts this warning. This is NOT the requested normal-conversation wizard integration. Existing conversation-setup mutates default; immutable addHarnessBinding requires common installation conversation authority. Selected-B conversion needs a designed local manifest/ref transition under lock with CAS, retaining old definitions/history; calling the existing command from the wizard alone is insufficient. No partial conversion is shipped. No active agent/key/provider context is changed.

Next: implement that local-owner transition and a conversation/diagnostic initial choice; adapt GOOSE_REVIEW_D22_EVIDENCE/review-goose-journey.test.ts for actual wizard through installed Start AND Restart under selected B/profile, cross-channel/later turns. Reusable prior proof remains explicit separate conversation-setup + Start, not integrated normal wizard or installed Restart. Claude/Codex/other providers, presets/custom/mesh/compute, live admission and startup-signal cleanup remain open.

Worktree /Users/loganj/.buzz/REPOS/beehive-cbfd9440, branch beehive/cbfd9440. Base 051c3a270be9c73da9ab06700bcab7d5552fceaa; continuation starts at 023c9274767ef50fa0f5b37ef1883336f8be59fd. Candidate is the commit containing this checkpoint (git rev-parse HEAD). No merge/release.

Relay persistence 796787 — publication gate

Final exact source: strict passes; DEFAULT concurrent installed-enabled full 69/70, natural 33.226s, zero skips/cancellations (publication-strict.log, publication-full-installed-default.log). All relay durability/upgrade/fault/drain/ restart tests, actual slots standby workflow, admission controls, ACP Restart, profiles, Move and installed conversation tests pass. One remaining failure in unchanged disconnect.test.ts:26: ENOENT reading fresh fixture term-seen, after group-absence assertion passed. That test uses spawnOwned directly, not the relay; no causal claim beyond that source boundary. Full engineering acceptance remains OPEN. No repeat run or out-of-scope containment repair. Prior preflight timing failure did not recur; its cause remains unclassified, not retroactively closed by this pass.

Concrete fix is committed/published with this checkpoint; final exact hash/clean-tree verification is in the terminal and workspace publication record. No production harness, wizard, client, native/Rust, credentials or provider changes. Fixtures only now observe actual durable TUI revisions/profiles, with original outer timeouts and assertions. New admission/Restart failure messages retain actual elapsed/receipts/ order/storage phases. Source hashes remain separate from installed executable hashes. History remains bounded full JSON snapshots/replay, not compaction or power-loss proof. Next: retain/classify the outstanding unrelated fixture and historical timing evidence, then wizard-to-installed Goose conversation continuity / remaining parity. No full product/live provider/current-kind-40002 or repository CI acceptance claim.

Final fixture self-review follow-up

The 69/70 executable result below remains retained, not erased. Before commit, self-review caught config driver's new observation-query prompts could leave its old cursor pointing behind those prompts; cursor now advances past consumed query output before awaiting the next command response. This is fixture-only, no operation retry or increased deadline. The residual Restart timing assertion now retains actual elapsed/receipt/order/storage phase evidence on failure (same bound). Final strict/default gate for these exact fixture changes follows; production relay source is unchanged from the 69/70 run. No further blind reruns are planned.

Relay persistence 796787 — retained pre-cursor gate

Concrete relay-only fix implemented: async atomic batched snapshots, serialized commit ownership, exact envelope/order/dedup, persist-before-echo/history, bounded queue, pre-replacement failure isolation, post-replacement uncertainty fencing, and close/drain. Host/key/state synchronous helpers and transport deadlines unchanged. Final executable strict passes. Final exact DEFAULT concurrent installed-enabled package gate 69/70, zero skips/cancellations, natural 32.234s. New relay regressions, actual slots standby/HTTP handshake, admission controls, profile/Move, configuration observation and installed conversation tests PASS. One residual: restart.test.ts:97 Stop interrupting ACP preflight exceeded unchanged <2500ms bound. Actual Stop result was accepted (preceding assertion passed); elapsed detail was not captured by that unchanged test. Cause UNCLASSIFIED, not attributed to storage or treated as acceptance. No further blind rerun. Full-suite engineering acceptance remains OPEN. No full-product/provider/production protocol claim.

Exact logs and separate source/binary hashes: WORK_LOGS/BEEHIVE_DESIGN_183FFAF0/RELAY_796787/ in the workspace; final-exact-{strict,full-installed-default}.log, final-source.sha256, installed-binaries.sha256. All earlier failures retained. No test retry, serial mode, force exit, assertion weakening or deadline inflation. New observation queries are bounded under original TUI outer deadlines, not retries of lifecycle operations. No repo-wide CI executed. Node24.15.0 / pnpm11.4.0; no dependency/config edits.

Self-review: received-prefix batch has one writer; history mutates only after both fsyncs; readers connecting during I/O replay old history then receive the commit; duplicate pending signatures cannot rewrite or reorder. Failed snapshot leaves no temp and no echo; later queued batch survives. Uncertain replacement stops further commit/replay, reports close error, and may be recovered unacknowledged on reopen. Close does not cancel already received work (even after disconnect), and waits for I/O before its callback. JSON encoding/full replay and 10,000-entry history/queue bounds remain; not compaction, cross-process multiwriter safety, or power-loss proof.

Next: separately resolve/instrument the residual preflight Stop timing failure, then wizard-to-installed Goose conversation continuity and remaining parity. Prior F1/F2/K1/A-B reviews are not reopened or claimed to cover this new relay delta. Commit uses verified configured Logan Johnson loganj@squareup.com author/committer and DCO; no cryptographic signing claim. Published exact head follows in terminal.

Relay persistence 796787 — implementation checkpoint

Sole writer continuation from d22ce81. Original relay writes the growing JSON snapshot synchronously per publication (file fsync + directory fsync), inside its WS message handler. Measured p93062 dial 2445545 -> error 2447560 is 2015ms; the supplied parent trace attributes delayed accept to synchronous persistence, not slow upgrade processing. The broader 2442459 -> 2447559 interval is 5100ms, NOT 2100ms. Historical admission failure is unclassified. Plan: relay-only asynchronous atomic snapshots, serialized commit ownership, commit-before-visibility and drain-on-close; retain synchronous host/key helpers. Deterministic storage-phase barriers/faults will bind the production writer. No deadline/reconnect policy changes. Strict + focused production-path relay/admission/slots/profile/Move/reconnect tests pass 22/22 (natural 20.989s). Five new barrier/fault regressions pass, including legacy file reopen and actual WS replay on restart. Final DEFAULT concurrent installed-enabled gate is next. Pre-replacement failure closes the publisher 1011 without history mutation, then queued siblings continue. Post-replacement directory failure is explicitly UNCERTAIN: no echo/history visibility, fence subsequent commits/readers, close callback reports the error; reopen may recover that unacknowledged replacement. Close stops admission and drains already queued work; disconnect does not cancel accepted queue entries. Snapshot format and synchronous host/key helpers unchanged. Logs (including first strict closure-narrowing error, now fixed) are retained at workspace WORK_LOGS/BEEHIVE_DESIGN_183FFAF0/RELAY_796787/.

Iteration before final batched snapshot gate

Initial one-snapshot-per-publication async candidate: DEFAULT installed-enabled full 64/70, natural 34.775s; failures admission (2), cancellation, configurations, policy TUI (actual output shows stale revision 0 vs expected 1), slots. Retained full-installed-default.log; do not relabel as success or causally classify all. Per-publication fsync retains unnecessary serial throughput cost, so the queue now commits the currently received prefix as ONE atomic snapshot. No delayed fsync, no new format/append-log and no visibility before the entire batch is durable. A blocked snapshot regression now queues two more distinct publications plus a duplicate: exactly two snapshots, all three ordered unique envelopes on disk/replay. Focused batch iteration 14/15 (configuration observation timeout); bounded TUI failure output added, no waits/assertions changed. Diagnostic focused concurrent 15/15; isolated config diagnostic 2/2 (nonrecurrence does not classify the timeout). Admission assertions now retain control/scenario, elapsed, actual receipts, persisted order and last 64 storage phase timestamps on failure. No timeout increase. Final batched candidate strict/full DEFAULT gate is next; source hashes stored apart from installed binary hashes. Self-review separated post-commit delivery exceptions from write failures; unexpected tail errors fence clients and surface at close.

Final observation-bound fixture gate

Batched DEFAULT installed-enabled run 68/70, natural 32.130s, no skips: admission/cancellation and new relay tests pass; config/slots TUI fixtures fail. Config bounded transcript proves Save issued against stale observed revision after private journal advance, then revision-conflict (step 13). Fixture now asks actual show for the required revision before issuing dependent commands, matching the existing slots pattern; no production wizard/harness changes. Slots source likewise issued numbered profile actions immediately after pending publication; it now asks actual profiles for the exact immutable instructions before using those rows. No operation retries, timeout/assertion relaxation, serial execution or force exit. Slots now preserves bounded step/output on driver failure. Focused observations plus relay 11/11, natural 17.769s. Historical slots timeout here lacks a transcript, so the source race correction is not retroactive proof of that particular timeout. Final exact candidate DEFAULT concurrent installed-enabled gate follows.

Goose / integrated local entry 768f — published partial checkpoint

Final strict passes. Exactly one final FULL DEFAULT concurrent installed-enabled package run completed 63/65, two failures, zero skips/cancellations, natural 35.904s. All four added Goose tests pass in the full run. The two failures are unchanged owners: slots.test.ts:131 standby host PID 96255 exits 1 with Opening handshake has timed out; admission-cancel.test.ts:126 controls exceed the unchanged <2500ms bound. No rerun, serial mode, assertion/deadline relaxation, or transport patch. The slots symptom recurs; this uninstrumented candidate run does not independently establish timing cause. Investigator's separate measured baseline finding is retained below; admission cause remains unclassified. Full-suite/engineering acceptance OPEN.

Self-review covered native model/no-fallback and subsequent update checks, provider env isolation, selected-binding inventory, hidden-reader handoff, exact public key/ owner/genesis checks, lock/fingerprint ownership and unchanged manifest/history. No dependency, old native/client, owner credential, provider login or production changes. Node24.15.0/pnpm11.4.0, installed hashes freshly match retained pins: buzz-acp 10612d0025d1420bdd9e9afcc2e7129377da2414e75049a8b640e81d857441ea, buzz 147cc2ccf276ddedc5b84d13f5399a95282066303c9dca566bb2af5a37b856c5. Exact executable source hashes are in GOOSE_768F/final-source.sha256, full result in full-installed-default.log, prior failures and focused logs retained beside it. Candidate is the commit containing this checkpoint; terminal publication records exact remote head/clean-tree and Logan Johnson author/committer+DCO verification. Next: review/repair the measured relay persistence owner without weakening durability or timing gates, then final concurrent validation; close the explicitly separate wizard-to-installed conversation integration gap before claiming that full journey.

Continuation from clean published 3b3ba27aa1436a46a5777f700af15bc4d90fb621. Actual implementation, not transport instrumentation. Source boundary remains pinned Buzz 051c3a270be9c73da9ab06700bcab7d5552fceaa (git-show, not checkout HEAD): Desktop discovery/catalog.rs Goose entry disables unstable ACP model switching, uses GOOSE_PROVIDER, GOOSE_MODEL, GOOSE_MODE=auto and Goose-owned config under ~/.config/goose/config.yaml; buzz-acp config.rs:792 supplies acp; acp.rs:707–719 supplies _goose/unstable/session/system-prompt/set, and :2150–2185 describes native category=model configOptions. Goose itself is NOT installed/executed by this work, and no upstream Goose-release compatibility or provider login is claimed.

Implemented a narrow spawn-fixed Goose local binding at existing host preparation, AgentSession and conversation broker owners. Separate service HOME/provider context, no Buzz Agent env/cache inheritance, no remote executable/env/credentials. Native session model currentValue plus advertised options must match the selected exact model. Missing/mismatched/ambiguous evidence rejects, never fallback to invented session/set_model support. Stable model-setting replies must re-establish native evidence; later model drift rejects. Profile uses the source-shaped Goose system prompt method in direct probes and the installed runtime's own implementation in conversation mode. Settings require selected-next Save and explicit fresh Restart. Inventory models/workspaces now follow selected binding, not original slot default.

setup <existing-host> enters the local wizard without allowing owner replacement; new setup offers Goose, independent NEW identity or hidden exact standby import against a public genesis. Existing wizard adds immutable Goose binding (source fingerprint rechecked under host.lock), existing-key reuse, new identities, hidden unknown standby import on a selected binding, and separately explicit retained public-only restoration. Common host/control/relay authority stays fixed. Import never grants Start, including initial hidden import. No key/session/workspace transfer. Initial host startup signal ownership is unchanged: handlers still start after ready; signal-during-startup cleanup remains unestablished, not silently claimed fixed.

Focused evidence: strict passes; UX/ACP/bindings 8/8, including actual CLI initial Goose new/reuse/hidden standby (macOS PTY, no key echo, 0600/0700), real host/relay profile/model/fresh-session Restart, wrong-model preflight preserving actual, neutral Stop without service HOME, stable identity/Y/manifest/history. Actual CLI add-Goose binding -> actual remote TUI model selection -> explicit Restart executes the native ACP consumer, preserving old fixture run/history and Y. Broker/key/installed 9/9: real installed buzz-acp + installed Buzz CLI, Goose-shaped TypeScript ACP fixture, 3 canonical signed same-agent replies, 2 channels, native model config and received profile, owner/member/thread fences, verified owned Stop/descendant absence. This installed proof enters ConversationSession directly, not the entire wizard-to-installed conversation path; the selected-setup journey separately exercises direct ACP. Do not combine those into a claim of an uninterrupted installed provider journey.

Retained iteration failures: initial strict env-union typing (fixed), installed Goose-shaped fixture omitted the native system-prompt method and exited; source inspection + bounded fixture method trace identified it, fixture corrected. New profile test initially did not publish its immutable revision; fixed test input. No deadline or assertions weakened. Logs in WORK_LOGS/BEEHIVE_DESIGN_183FFAF0/GOOSE_768F/ (workspace absolute prefix /Users/loganj/.buzz/). Source and installed-binary attribution remain separate.

Consumed investigator 521307cf terminal a7fb3981: one immutable full capture 60/61; slots standby handshake recurred with synchronous relay persistence starving accept; admission controls passed, prior failure still unclassified. No investigator edits copied; no transport change or further diagnostic/full rerun-to-green here. Final strict/default concurrent installed-enabled gate follows this checkpoint after capture completion. Engineering acceptance remains open until its exact result is recorded. Full Claude/Codex/provider/preset/custom/mesh/compute parity, live Goose/provider auth, production kind-40002 admission, destructive binding editing/deletion and one continuous wizard -> installed conversation journey remain. Previous K1/F1/F2 reviews stay closed.

Startup / local wizard 7b70 checkpoint

Continuation from clean published 6a28b390db2caca6d45699f91709a2d9a277b053. Evidence directory: WORK_LOGS/BEEHIVE_DESIGN_183FFAF0/STARTUP_7B70/. Predecessor BINDINGS_FD5123 logs are untouched. Strict + initial transport/reconnect 5/5 and local wizard/binding 3/3 focused passed before final gate.

Proved: configured ws handshake timeout is 2000ms. Its initial error rejects client.ready; host catch closes the client and removes the owned lock; CLI prints that error and exits 1. Initial failure is deliberately NOT established recovery. The slots child driver awaits asynchronous 20ms polling; it does not synchronously wait on its relay process. Relay awaits listening before the child is launched. Relay verification/persistence/history delivery are synchronous work on the test process event loop, but the captured run has no timing/upgrade trace proving that work delayed this handshake. Contention/readiness/event-loop cause remains unclassified, as do unrelated historical timeouts. No production retry, timeout inflation, serial default or rerun-to-green was introduced. Deterministic withheld-upgrade, cancellation and HTTP denial probes bind the actual client/host. Transport-level close aborts startup; CLI signals are still installed only after host readiness, so signal-during-startup lock cleanup is not claimed by this test.

Product increment: local-setup lists/reuses bindings/identities, adds compatible immutable binding IDs, creates independent keys on a selected binding, or restores an exact retained key through the hidden reader. Mutation APIs revalidate draft source fingerprints under atomic host.lock; no key goes into binding data. New binding and subsequent agent creation are two separately confirmed actions, not a torn multi-write wizard transaction. Real CLI setup -> binding B -> remote A/B Restart/Move test preserves existing identity/profile/history/sibling guarantees. No edit/delete, second real harness, provider form, live auth, current production kind-40002 or full-product acceptance. Initial setup/unknown standby key import still use their existing separate flows. K1/F1/F2 closed prior reviews remain reusable, not reopened or claimed as independent review of this increment.

Final strict passes. Exactly one final FULL DEFAULT concurrent installed-enabled run naturally completed 59/61, two failures, no skips/cancellations, 35.513s. All new startup/wizard probes and the real CLI->remote A/B journey passed. Failures: (1) slots.test.ts:131 standby host PID 88992 exited 1 before online, bounded stderr Opening handshake has timed out; underlying cause still unclassified, NOT fixed; (2) admission-cancel.test.ts:126 Controls must resolve without waiting on a run asserted elapsed time <2500ms; this run exceeded that bound, cause unclassified. Neither failure was rerun, suppressed or attributed to contention without evidence. Full-suite acceptance remains OPEN; natural full log and focused logs are retained. Self-review checked one-action writes, private key exclusion, hidden reader ownership, stale-input lock checks, unchanged history and no new provider claims. Installed binaries were read-only/hashed separately; source hashes saved beside logs. No repo-wide CI, production/provider activity, dependency or persistent git config change.

One next diagnostic: instrument the actual slots relay's upgrade/event-loop timing in a bounded fixture-owned trace to distinguish parent work from transport delay; do not change retry/deadline policy on this evidence. Product remaining: initial new/standby-import unification and startup-signal cleanup ownership, followed by properly grounded real harness/provider parity.

Binding fd5123 — published-candidate partial handoff

Executable candidate is the commit containing this section; remote verification is reported in the terminal handoff. Recovered baseline was exact published 1e6ead550e0bbf6cf8f817d07732a9b88fc84160. Final strict passes. Final FULL DEFAULT concurrent installed-enabled package: 56/57, one failure, zero skips/cancellations, natural exit 34.240s. All four new binding tests passed in that full run. Failure is unchanged slots standby startup at slots.test.ts:131: host PID 75606 exited 1, stdout empty, stderr Opening handshake has timed out. This newly captured occurrence is a management transport opening-handshake timeout; underlying cause and relation to historical unclassified timeouts are not established. Full-suite acceptance remains open. No serial masking, timeout inflation or rerun-to-green. Earlier full 56/57 (33.129s) failed the new TUI driver observation gate, preserved separately; revision-observation correction is documented below.

Final run evidence: X 35de98eee5ce7b9be24e5d11d96cb76365f118a396d487647979ee02073dc9bd, Y eeb07ddb3898d66c66f4031f9c7fb70e01297eed74ecf0bd24300a62cea85f2f; A fingerprint b0e30b92cfa4a24deea32d53252d5612b65e5f483f28a87dd14970752147ae92, source B 77afae3f04095f15e778d9bd6a4c8c882663f49600eec0e0dd590db0dbdff80c, target B 97aac17667d55c62d182fcb6ae67f38432170c9bb7fdd9996dbdb8c0465da75a. B received exact profile marker/revision fa46ad839d945ac1016e3f75d18eb1146aa5c12717f3111c96e514bb1c013717. Named Alternative@4 applies only on explicit Restart; actual A and history retain A, same identity, Y whole journal byte-identical, both host-local manifests retain independent keys/authority. Target uses its different B fingerprint and preserved source behavior. Replay and explicit stale-definition refusal remain tested.

Self-reviewed resolver use at Save/cancellation/preflight/actual launch; immutable binding API owns the same atomic mkdir lock as Start. No parallel controller/runtime, remote executable/env injection or key rewrite. K1/F1/F2 independent reviews are reused unchanged, not reopened and not claimed as independent review of this delta. Installed runtime/CLI hashes separately rechecked and match retained pins; source hashes, both failures and focused/full logs are in BINDINGS_FD5123. No dependency or global config changes. Logan Johnson author/committer + DCO, no crypto signer.

Next: investigate the freshly captured management opening-handshake failure under the default concurrent installed-enabled shape without widening deadlines, then repeat final strict/full on any corrected candidate. Integrated setup wizard, full binding CRUD, Goose/provider path and full parity remain. This is actual fixture A/B execution, not full-product/live-provider/current production kind-40002, normal service-user OAuth, repo-wide CI, merge/release or production acceptance.

Binding fd5123 — concurrent validation correction

First strict passed; FULL DEFAULT installed-enabled naturally exited 56/57, one new A/B TUI driver gate failure (33.129s). Original failure log lacks the step/output, so its specific missed observation remains unclassified. The new driver copied an 80ms sleep from configurations.test.ts as a supposed receipt→inventory fence. This is not a valid observation barrier; replaced it with existing slots-test actual TUI show revision observation before revision-sensitive commands. Failure now retains step and bounded TUI output. No test timeout inflation, removed assertion, changed product admission or serial run. Revised strict and focused TUI/lock 2/2 pass (10.570s). Final DEFAULT full run follows on this changed test candidate; original failure remains in full-installed-default.log, not overwritten or called diagnosed.

Binding fd5123 — pre-final-validation checkpoint

Focused new tests pass 4/4 (9.445s): actual source/target host subprocesses, relay and named TUI A→B Restart with selected profile received by distinct runner, unchanged X identity/Y whole journal/A history, different target-local B fingerprint, manifest-neutral Save replay, unknown/stale binding rejection, standby B configuration, profile-preserving Move. Explicit-B recovery adds consumed-grant replay after changed local definition/restart, stale explicit Start refusal without fallback, late standby Save/CAS assigned-stopped behavior. Atomic host.lock excludes local mutation and real competing CLI Start; 0600/0700 and identity/authority injection refusal checked. Self-review retains old unreferenced configurations on their original slot default; explicit references never fallback. Conversation authority is equality-fenced across bindings, conservatively not independently editable. Changed add-binding comparison from JSON order to semantic equality; no runtime/controller added.

Evidence: /Users/loganj/.buzz/WORK_LOGS/BEEHIVE_DESIGN_183FFAF0/BINDINGS_FD5123/. Two test-extension failures are retained: stale Move fixture omitted source profile; extra standby probe wrongly expected non-authority after restart replayed grant. Corrected test inputs/sequencing, no production assertions/timeouts weakened. Final strict and FULL DEFAULT concurrent installed-enabled package are next; no suite acceptance yet. Integrated wizard/full CRUD/Goose/full parity/live provider, normal OAuth and current production kind-40002 acceptance remain outside this slice.

Recovery fd5123 — sole writer

Recovered local HEAD and exact remote branch at 1e6ead550e0bbf6cf8f817d07732a9b88fc84160; no intervening publication. Preserved seven modified files and two untracked A/B test files from retired worker; no reset/clean or private journals. Read applicable repository/package instructions and actual diff. Surviving delta wires selection references into local resolution and adds lock-protected immutable provisioning; it is not yet validated. Next: focused A/B execution, self-review, then strict and FULL DEFAULT concurrent installed-enabled package on final candidate. Earlier K1/F1/F2 reviews stay closed; historical startup timeout remains unclassified.

Reusable binding execution — active implementation boundary

This continuation resolves an explicit public harnessSetup {id,fingerprint} through the existing slot preparation owner; the selected binding now supplies actual runner/ACP inputs, Save validation, cancellation and destination Move preflight. Local immutable binding provisioning acquires atomic mkdir host.lock; no key/authority copy, journal rewrite or remote executable/env provisioning. Legacy unreferenced selections retain their slot's original default binding. Remote binding <id> edits the current named configuration; Start/Restart remain explicit. A/B external-runner + actual TUI regression is being executed before full validation. CRUD/edit/removal wizard, integrated setup UX, Goose/live provider and full parity remain deferred. No diagnostic iteration.

Correction: K1 independently CLOSED at 6a5a4592, per KEY_IMPORT_VERIFICATION_6A5A4592.md: original missing/mismatch guards, hidden exact-key import/public-only authority and real competing-start lock barriers passed strict + 6/6 + 3/3. F1/F2 closure remains independently recorded in NAMED_MOVE_VERIFICATION_2151EA3A.md. Historical review-pending text below does not reopen these findings.

Startup diagnostic continuation d8fe — tested partial handoff

Starting clean published 6a5a459246. The slots subprocess driver now keeps bounded 8 KiB stdout/stderr tails and reports actual exit/signal/spawn error when readiness fails, instead of discarding stderr and emitting only a polling timeout. Same 400 × 20 ms readiness bound; no timeout inflation, serial default or assertion weakening. Early-exit and spawn-error regressions bind this driver. Strict + driver/slots focused 6/6 pass (19.95s), including the formerly failing standby launch. Historical cause remains unclassified; this non-recurrence is not a diagnosis. Final executable candidate: strict passes; full DEFAULT concurrent installed-enabled package 53/53 pass, zero skips, natural 32.062s on Node 24.15.0. The former standby workflow passes in 19.53s within that full shape. No production startup cause was established or patched. Evidence (focused/full logs, exact source and separate installed binary hashes) lives in WORK_LOGS/BEEHIVE_DESIGN_183FFAF0/BINDINGS_D8FE/.

Concrete binding decision from source inspection: keep identity/authority solely in installation agents + retained journals, reuse installation setups as local named definitions, and add an explicit setup reference/fingerprint to nonsecret selected configuration at the existing selection/preflight owner (not a new registry/controller). Local mutations must acquire mkdir host.lock across read/validate/write, the same exclusion owner as host startup; absence checks alone are insufficient. Referenced edits must not relabel actual/history; stale selection/preparation must refuse without fallback. Current host captures ONE setup and mode in its slot closure, and Save/cancellation/Move all consult it: merely adding CRUD or inventory options would falsely advertise A/B support. This continuation has not yet changed that boundary or implemented the integrated wizard/Goose path; no new binding/provider parity claim.

Secure local key reuse increment — intentionally partial second phase

Published K1 separately as 08be5d6eb4. This continuation adds an executable import-agent-key local wizard, hidden terminal input (protected stdin supported), exact public-key match, installation lock and shared retained-authority validation before a secret-only atomic manifest write. It cannot mint authority, recreate unknown slots or replace existing keys. Retained standby/source-consumed assignment is not changed by importing its key. Actual CLI/PTY import test + real host/relay standby denial passes (1.41s); strict passes. Initial PTY attempts failed because macOS script refuses Node socketpair stdin; retained import-focused logs 1–4 capture this adapter failure, then fixed adapter uses a real shell pipe. No product assertions or timeouts were weakened. Evidence: WORK_LOGS/BEEHIVE_DESIGN_183FFAF0/K1_928F/.

Grounding read: HARNESS_PROVIDER_UX_GROUNDING.md. No provider abstraction or executable/auth claim added. Second-phase partial: multiple reusable local bindings CRUD, remote exact A/B selection/fingerprints, integrated initial new/import/reuse wizard, and second Goose executable/provider/service-env path remain unimplemented. Next executable step is local binding management + advertised selection at the governing host preflight/configuration boundary, followed by source-pinned Goose ACP fixture acceptance; not a design-only task or parity claim. Final strict/default concurrent installed-enabled results will be recorded below.

K1 retained-authority removal — explicit closure

Inspected immutable 2151ea3a: K1 was NOT fixed by the named Move commit. loadSlotState now owns the existing host hydration validation (binding, owner/agent genesis, full assignment/grant chain, selected/configuration codec). Both host hydration and destructive local key removal use that same read-only loader. No new assignment synthesis, no execution-holder-equals-this-host gate. All validation precedes manifest mutation; retained journal is never written.

Actual CLI regressions reproduce missing assignment and mismatched agent genesis, plus wrong owner/holder, malformed chain, wrong root/predecessor/grant agent and operation. All refuse exit 1 without success text and preserve manifest, selected journal and sibling bytes. Valid stopped, standby and consumed-source controls remove successfully and pass the same public reopen loader. Existing real host, relay, removal/reopen/lifecycle and both Move directions pass: focused 5/5, natural 12.98s. Strict passes. Initial extraction strict failure (genesis local scope) is retained in WORK_LOGS/BEEHIVE_DESIGN_183FFAF0/K1_928F/strict.log; corrected strict2/focused logs alongside. No local deletion is global revocation. K1 is checkpointed separately before the reusable-binding/import continuation. Final full concurrent installed-enabled package validation remains due on the final candidate; prior timeout/failure history below is not reclassified.

Named Move F1/F2 — implemented; final validation/publication below

Starting verified clean published 7ad542080d72f5e04692a207286d20a87646269f. Consumed final independent NAMED_SETUP_REVIEW_4D26C2E1.md and original recovery TUI/wire probes (not the superseded candidate-comparison hypothesis).

F1 owner: strict selection codec equality, including nested configuration and profile fields; adjacent target-local comparison validates before separating behavior. Local setup/prepared-input hashes canonicalize object members but preserve arrays. Raw hash-chain/predecessor/operation/retry identity hashes are deliberately unchanged; no saved events are reserialized/re-signed. Historical grant meaning remains readable.

F2 governing model: profiles stay independent immutable behavior revisions; named launch configurations are per-agent effective snapshots, not display labels. named-v1 grant materialization derives source-selected public behavior + target-local model/workspace/name as a NEW named revision: max(target CAS revision + 1, previous named revision + 1). Legacy implicit default@1 is materialized by new Moves too; there is no separate unnamed inventory/selected behavior path. Even unchanged behavior receives a new revision for this Move. Preparation validates/bounds the resulting inventory before source effects and atomically reserves that revision with its immutable token/reply and original target candidate. This captures the prior destination definition and prevents a concurrent later Save from assigning different content to the reserved reference. Cancelled preparations can leave revision gaps; reservations are not Start/assignment authority. A retry cannot renew the token, candidate or reservation, including after restart.

Source validates/derives that same effective snapshot before Stop; its consumed grant and outbox remain one durable write. Target compares against the reserved revision, then commits assignment + named inventory + selected-next together, before ordinary Start. Later standby Save retains its later candidate, advances the fence and leaves accepted authority assigned/stopped. Legacy grants that would redefine an old reference instead preserve the candidate and stop; historical accepted grants and actual/history snapshots are never rewritten. Both sides need this development materialization contract for new named Moves; no mixed-version rollout claim.

Regressions: original reviewer actual TUI profiled source → Destination@1/default now succeeds WITHOUT an object-order workaround; actual, selected-next, inventory and versioned grant all use Destination@2/Source. Original Destination@1/default remains in preparation evidence. Reselect + Restart, both service reopens, duplicate Move/grant, former source/target actual/history and recursively reordered real wire Move are checked. Fresh profiled/named dropped-grant cases exercise target restart with changed inputs, stale reservation CAS, later same-name Save allocating @3 rather than overwriting @2, assigned/stopped acceptance, original preparation preservation and source non-resurrection. Unit negatives reject extra/missing/different grant/selection fields and unknown versions; arrays remain order-sensitive. Existing installed conversation fixture remains deterministic.

Iteration evidence (not hidden): first focused Move run 1/6: validating the local behavior-stripped comparison still passed an explicit undefined behavior property to fields; fixed at shared validated comparator by omitting that property after codec validation. Next original Move run 6/6. First new TUI probe passed at runtime but strict reported an unknown receipt result in the adapted test; corrected String conversion. Focused combinations then 4/4, 3/3 and named recovery 2/2. First full DEFAULT concurrent installed-enabled run 47/49 (34.38s): reverse Move's old revision-4 wait was obsolete because its named preparation now reserves 4 and Start commits 5; exact wait/Stop assertions updated to 5, not removed. Separate slots standby-launch evidence timeout remains unclassified; no attribution to pre-existing/contention/removal without causal logs. Focused original Move + slots 10/10 passed subsequently, not proof of that cause. Prior removal 43/45 failures likewise remain scoped observations despite green reruns.

An intermediate final-tree strict + full DEFAULT concurrent installed-enabled run passed 49/49, zero skips/cancellations, natural 32.08s. Subsequent self-review extended the same materialization rule to legacy implicit default@1 (otherwise that projected inventory could still split from selected-next). Original Move tests now assert default@2 / Start revision 3 explicitly, later-Save @3, and cancelled-reservation CAS 2. Focused original Move + strict semantic codec 7/7 pass; existing M1/replay/Stop/Save assertions retained. Four full attempts after implicit-default self-review were interrupted at the unchanged 110s tool bound without a package summary (full-installed-exact, full-installed-publication, full-diagnostic, full-direct-diagnostic). Two were diagnostic-only runs; temporary instrumentation is removed. Each reported passing installed Move/new/Move/M1/key cases before output stopped ahead of slots. These are NOT completed/green suites. A direct fixture-owned diagnostic finally captured slots TUI pending at step 27 waiting for Restart revision 4 after its Restart received revision-conflict. The driver had gated on private host journal revision 3, not the TUI's inventory observation; its unhandled rejected gate also left the child UI alive until the outer tool deadline. The bounded driver now uses actual show responses to observe the exact committed revision before Start/Restart/Stop, retains all original assertions/8s observation bound, and propagates gate errors after closing its own UI. No product CAS bypass, longer sleep/deadline, serial masking or force-exit. This explains the captured diagnostic journey, NOT every earlier timeout from logs lacking that evidence. Isolated slots 4/4 had also passed and is not causal proof. Strict + DEFAULT concurrent installed-enabled full after this driver correction passed 49/49, zero skips/cancellations, natural 33.28s (full-ui-observation.log). Final exact-tree strict/full validation and source publication are recorded in terminal evidence/logs. Logs: WORK_LOGS/BEEHIVE_DESIGN_183FFAF0/NAMED_MOVE_6AFE/. Independent prior named review consumed; this delta has self-review and executable evidence, NOT independent approval, production admission, live-provider or full-product acceptance. No secrets in output/relay; public-only key removal, local harness credentials and sibling isolation are unchanged. ONE next executable action: multiple local harness bindings and import/reuse wizard/Desktop parity, after independent confirmation of these blocker fixes.

RECOVERED removal-public-slots — recovered clean; implementation begins

Recovered sole-writer worktree /Users/loganj/.buzz/REPOS/beehive-cbfd9440 branch beehive/cbfd9440 at verified published pre-run 4d26c2e1921f3e20f57888f9124ae0611334464f: clean tree, no stash/untracked source, remote FETCH_HEAD identical, reflog shows only the prior task's amend. Prior writer 4aa4e8ab cancelled with NO removal commit, push or surviving edit; nothing to preserve or repeat. Immutable named-config review 818c3724 is read-only and untouched. This section is written BEFORE implementation or long validation.

Planned bounded scope (no wider wizard/harness CRUD): local deliberate agent-key removal as a retained public-only slot under the stopped installation lock (refuse when lock present — no PID/stale-lock removal), validating public key/journal identity/stopped phase, preserving 0600/0700 and public identity/genesis/assignment/config/profile/receipt/run history plus sibling keys. Host reopen advertises the missing-key public slot; Start/Restart reject before spawn; Stop/Save/inspect/reconnect stay credential-neutral; remote operations never recreate the secret. Move TO a missing-key target rejects during destination preflight before source Stop; Move FROM a public-only source follows the existing grant contract (assignment consumed, no key transfer/reconstruction/takeover). No remote key CRUD, controller or privileged HTTP; no shadow identity — the execution credential becomes an optional loader. Planned validation: actual local CLI + host/client/relay tests, focused first, then strict + DEFAULT concurrent installed-enabled full suite on the exact final candidate (baseline 41/41).

Removal public-slots — implemented, validated, published head in terminal result

Started published 4d26c2e1921f3e20f57888f9124ae0611334464f (prior writer 14c23528 handoff: uncommitted patch, strict pass, NO executable tests/commit/push). This candidate is the commit containing this section. The prior run's drafted remove-key.test.ts was never saved to disk; it was written fresh here, then executed.

Implemented (validated, not re-implemented): removeSlotKey refuses any installation lock (no PID/stale-lock removal), validates public identity + stopped slot/no actual, atomically nulls only the secret in the 0600 manifest, retains sibling/owner/history; addSlot refuses recreating a public-only slot; host execution credential is optional with missing-key Start/Restart rejection before effects, public inventory localKey/readiness, neutral Stop/Save; conversation prepared credential; CLI remove-agent-key <dir> [public-key] with confirmation; assignment-export works public-only; conversation-setup/migration missing key reject.

Real defect found and fixed at its owner: the inherited patch's migrateSlots destructure had dropped agentSecret from the omission list, so a migrated v2 manifest kept the legacy key inside setups.default — installationSlots silently re-armed a secret: null public-only slot from that retained key, defeating removal (Start would have launched and Move inventory never showed the removal). Fixed by restoring the omission, plus a fail-closed readInstallation check that shared harness entries never carry key material. Regression is executable, not a test workaround.

Validation: strict TypeScript passes; fresh test/remove-key.test.ts focused 4/4 (removal journey incl. CLI confirmation/no-secret-stdout, 0600/0700, byte-identical journal/sibling, reopen advertising, pre-spawn Start/Restart denial with fixture-runner line-count proof, neutral Stop/Save, reconnect replay; active-lock refusal without lock deletion, non-stopped/unknown/malformed/already-removed fail-closed, legacy key-less remove/migrate/conversation-setup/host-startup refusal, public-only conversation-setup refusal; Move-to-missing-key destination preflight failure preserving the running source; public-only source Move consuming retained management authority with destination launching on its own local key, source manifest byte-identical, consumed source Start denied). Adjacent slots/move/assignment/configurations 14/14. First strict + DEFAULT concurrent installed-enabled BEEHIVE_REAL_BUZZ_ACP=/Applications/Buzz.app/Contents/MacOS/buzz-acp npm test full run 45/45, natural exit 30.27s. On the final tree (identical test-relevant source; only docs edited) one full run recorded 43/45: two PRE-EXISTING tests (cancellation.test.ts same-batch Stop, slots.test.ts real TUI lifecycle) failed with Missing … evidence timeouts — the historically documented intermittent concurrent-fixture contention, NOT a removal regression (all four removal tests passed in that run). Targeted rerun of both files 5/5, then a fresh complete DEFAULT concurrent installed-enabled run 45/45 pass, zero skips/failures, natural exit 30.19s (baseline 41 + 4 new) under Hermit Node 24.15.0 / pnpm 11.4.0, standalone frozen lock unchanged. Installed runtime 10612d00…ea and CLI 147cc2cc…5c freshly match the retained pins. No serial mode, timeout weakening or containment assertion change; the intermittent observation is recorded, not silently classified as fixed. Evidence: WORK_LOGS/BEEHIVE_DESIGN_183FFAF0/REMOVAL_PUBLICATION/ (focused-remove-key.log, focused-adjacent.log, full-installed.log, full-installed-final.log (43/45), intermittent-rerun-targeted.log, full-installed-final2.log (45/45), installed-binaries.sha256).

Consumed independent named-setup review NAMED_SETUP_REVIEW_4D26C2E1.md — TWO findings remain OPEN and deliberately NOT fixed here (out of this bounded task): (F1) property-order-sensitive grant equality at handoff.ts:32 reached from host.ts:196-197 rejects an actual TUI profiled Move to a named default-profile destination (do not fix only host.ts:208); (F2) accepted Move updates selected-next but not the named inventory (host.ts:266-274), so the same Destination@1 can mean different instructions. This removal delta's own Move tests use plain default selections and do not intersect those seams; no workaround was combined into that review's approval. ONE next executable step: fix F1/F2 at the natural grant/candidate owner with the review's regression combinations.

Remaining: local key REPAIR/re-provision reconciliation UX (removal is one-way by design), nsec import/saved-owner verification/remote revocation UX, full import/reuse wizard, local setup CRUD/multiple setup bindings, other harnesses/providers/presets, mesh/compute, production admission/OAuth/live-model gates, final UX review. Removal is a local copy deletion — not global cryptographic revocation; no nsec transfer or remote key CRUD exists. Historical unrecorded broker failure remains unclassified.

Named configurations 6bf9 — usable increment, local parity still partial

Started published e70f90f9aec26248022aa1081339548e1ade9ea4. Candidate is this commit (git rev-parse HEAD); exact published head is in terminal result.

Implemented: existing per-agent journal/Save/CAS now owns bounded named launch candidates (create, Save, list, select, rename, inactive removal). Names and revision numbers are captured in immutable actual selections and survive removal/rename in run history. Revision numbers use the host/agent journal generation, never reset on name reuse. Existing default selection is projected without lossy history migration; old actuals remain legacy/unversioned. One atomic persist contains registry, selected-next and receipt. No second profile/provider/credential authority. One harness setup per slot is exposed with nonsecret ID/kind/allowed model/workspace; actual-run includes the shared setup definition fingerprint (excluding agent/owner keys), executable digest and complete prepared-input fingerprint. Setup fingerprints do not claim credential-cache generation or pin executable replacement across spawn.

Local wizard: setup directly creates shared slots; no migrate-slots paperwork for a new host. Choose fixture or existing Buzz Agent Databricks v2, local executable, allowed workspaces, see harness-specific sign-in/service uid/HOME/config context, then deliberately create independent keys using that same harness setup. Optional owner-only key/root file import still attaches standby to existing genesis. Subsequent named configuration changes never recreate/import/copy keys. Local structural changes require the host stopped/exclusion lock; no management HTTP, implicit lifecycle or login. This is a smaller first-setup flow, not complete key/setup CRUD or Desktop parity.

Standby and Move: public Save is now allowed on an exact standby agent/host; Start/Restart/Stop/Move remain assignment-fenced. Preparation validates the exact observed destination candidate, with source-selected behavior authoritative. Self-review caught the newly reachable target-Save-after-prepare race: accepting a later Save must not strand an already consumed grant. Grant acceptance preserves that later candidate, advances authority/revision, stays stopped and requires explicit Start. No mixed-input launch, discarded accepted Save or source resurrection. Prepared/grant records stay immutable and duplicate replay stays inert. Normal successful Move applies exact target name/revision/workspace and source behavior, not a floating current candidate.

Actual acceptance: configurations.test.ts drives real local wizard and real TUI subprocesses through two identities sharing one setup; checks 0600 files/0700 directory and no fixture secrets in wizard stdout. X starts, creates Alternative, saves another allowed workspace, selects default/Alternative while actual stays identical, then Restart applies Alternative@3/exact workspace/same setup fingerprint and identity. Y's complete journal stays byte-identical. Target Destination@2 is prepared remotely, Start denied; stale candidate Move preserves source, exact candidate Move succeeds. Remote rename/removal leave actual/history unchanged; unsupported selection rejects at owner. Manifest remains byte-identical throughout remote work: no key/setup rewrite. New dropped-grant/remote-target-Save regression proves assigned/stopped acceptance, later selection preserved, immutable preparation and no source resurrection on reopen. Existing actual profile/Restart/Move instruction tests retain behavior evidence.

Validation: final executable strict + installed-enabled DEFAULT concurrent package 41/41, zero skips/failures, natural exit 29.285s. Previous complete candidate 41/41 30.746s; final only improves concise named list/current-next labels. Earlier focused 10/11 exposed reverse-Move test constructing a stale selection without the new configuration tag; fixture now supplies exact observed selected-next, matching the new target-candidate contract (no weakened production checks). Prior full 38/38 and new focused 8/8 also passed. No serial/force-exit or timeout/containment assertion changes. Logs/source hashes/binary hashes in workspace WORK_LOGS/BEEHIVE_DESIGN_183FFAF0/NAMED_CONFIGURATIONS_6BF9/.

Independent review consumed: PROFILE_RESTART_REVIEW_E70F90F9.md, no supported blocking finding, independent strict/default installed-enabled 38/38 at pinned predecessor. Additional independent installed Restart probe establishes same signer, new actual run/session and B instructions on replacement/next turn; actual TUI branch/ default and relay trust-boundary probes passed. Reviewer corrected an overstrict later-turn-prompt repetition oracle, with initial failure retained. This new named configuration/standby-Save delta is self-reviewed, NOT independently approved by that predecessor report. No repository-wide CI or live provider approval claimed.

Remaining: key removal/revocation with retained public assignment/history and public-only missing-key slot inventory; complete import/reuse wizard; local harness setup CRUD/multiple remotely selectable setup bindings; a materially different Goose/Claude Code/Codex path and vendor/adaptor auth, remaining Buzz Agent providers, ten presets/custom ACP/mesh/compute; final independent simple UX review and production kind-40002/admission/normal service-user Databricks OAuth/live exact model. Current wizard has fixture + existing Buzz Agent path only: fixture is not Desktop harness parity. Historical unrecorded broker failure remains unclassified. Trusted exclusive non-cloned/non-rollback POSIX installations/shared-owner physical-host limits remain.

One next executable step: implement local deliberate key removal as a retained public-only slot (not deleting the slot/journal), with stopped installation exclusion; exercise remove → service reopen → advertised missing-key state → rejected Start/ Restart/Move without reconstruction, while Stop/history and a sibling stay truthful.

Behavior profiles 0aa71 — implemented application and durable actual evidence

Started clean published e6717541d4580541cd24816e062d893a49260bbc. Candidate is this commit (git rev-parse HEAD); publication head is in the terminal result. Named nonsecret behavior profiles and explicit per-agent application are implemented, not another Restart-only prerequisite. No architecture/host/credential replacement.

Definition authority: immutable owner-authenticated encrypted relay publications; src/profiles.ts alone owns canonical name/parent/instructions content addresses and lineage projection. UI and hosts replay that code, not writable prompt replicas. Concurrent children remain explicit branches; incomplete lineage is visible and not selectable. No timestamp/latest selection. Draft form → signed durable publication → separate assigned-host Save/CAS acceptance → explicit Start/Restart. Current TUI commands: profile-new, profiles, profile-edit <number>, apply <number|default>. Numbered profile choices are captured from the displayed list; publishing shows observed affected host/agent associations and never changes them. No JSON/journal-ID editing, profile provider/model/credential fields or local profile admin commands.

Captured application: selected-next contains the validated full immutable revision. The existing Start/Restart/Move preparation hash covers effective behavior. Launch never reads a mutable catalog head across awaits. Actual run retains full selection, profile revision, explicit instruction SHA256, prepared-input hash, executable/run and existing session evidence. Successful snapshots persist in per-agent runs, unmodified by later Save/Restart/Stop; inventory exposes recent hash/revision summaries. Old journals are not migrated or synthesized into historical proof. Default remains absence of an override (upstream-default, no invented text hash). apply default is explicit selected-next clearing. No destructive profile deletion is supported; immutable revisions/history remain resolvable. Bounds: 2 KiB instructions, 1,000 versions/runs, 100 parent edges; full run history blocks Start/Restart, never Stop. Bounded wire/Move-lineage checks prevent oversized new grants consuming authority.

Actual external evidence: captured instructions use established upstream BUZZ_AGENT_SYSTEM_PROMPT and installed BUZZ_ACP_SYSTEM_PROMPT, not a new broker prompt owner. Real two-agent TUI creates A, selects/starts X, starts Y default, publishes B, applies B while X runs (X actual A and complete Y journal unchanged), then Restart X with same identity/new run/process and external received B bytes. profiles.test.ts proves external ACP preflight and actual launch both receive B while publication C / Save races Restart; C Save conflicts, no mixed inputs. Stop cancels a later delayed Restart with no revival. Canonical/tampered hash, unexpected fields, missing lineage, branches, invalid references and stale selection tests pass. Old actual snapshot survives Restart/Stop. Real durable-client Restart receipt loss BEFORE relay storage recovers outbox on reopen, unchanged journal and exactly two launches (no extra one).

Actual two-host TUI Move now preserves source-selected instructions despite target's default config; target external process records the same bytes, Y journal unchanged. Installed conversation acceptance passes the profile marker into both actual harness environment and the installed runtime-generated ACP prompt; three native signed replies still obey owner/member/thread/model fences. This is installed Start/runtime propagation, not installed-conversation Restart or live-model behavior proof. Actual Restart uses deterministic external lifecycle/ACP fixtures with new process/run; fixture session labels are process-scoped, not global session-uniqueness evidence. Instruction hash covers the profile override, not upstream orientation/memory/history.

Validation: final strict + installed-enabled DEFAULT concurrent npm test 38/38, zero skips/failures, natural exit 29.50s. No serial mode/test-script changes. First full 38/38 29.78s; after history additions full 37/38 29.53s, exact failure broker.test.ts:33, existing-but-empty reverse-rpc marker ('' !== 'ok'). Fixture open/truncate/write vs existence-gated reader was corrected by atomic marker rename; broker assertion/timeout and production code unchanged. Targeted broker 1/1, then final full above. This does NOT classify the older unrecorded broker failure. New Move boundary assertion initially read before the external fixture recorded startup; now awaits explicit received-byte evidence before asserting, targeted 5/5. No owned exit/ESRCH assertion changed, no broad stress campaign. All retained logs/hashes: /Users/loganj/.buzz/WORK_LOGS/BEEHIVE_DESIGN_183FFAF0/PROFILES_0AA71/. Installed runtime and CLI hashes freshly match prior pins; binary attribution remains separate from source. Standalone dependencies/lock unchanged. No owner private stores, provider/login/production operations, Rust/native changes, remote secrets or keys.

Review / next executable action: independently review this published profile delta TOGETHER with predecessor Restart, especially publication/association separation, immutable captured inputs, history, Move behavior preservation and lost-receipt tests. Self-review performed; no independent new review or repo-wide/GitHub CI claimed. Prior CONVERSATION_MOVE review remains consumed, not reopened. Scoped live-anchor POSIX ownership and trusted non-cloned/non-rollback installation assumptions remain; no arbitrary escaped-tree/physical-host/partition/clone/rollback-safe claim.

Remaining scope stays visible: local key/setup CRUD + small harness-specific wizard, named launch configurations and retention/history UI, Desktop harness/provider/preset/ custom/mesh/compute parity, final real-TUI UX/live acceptance, production kind-40002/ admission and normal service-user Databricks OAuth/live exact-model gate. Those are not completed or replaced by deterministic profile/Restart acceptance.

Restart continuation dad771 — partial product handoff

Started clean published a235638e0a879c3b93bec39b8b27f415c03ab181; candidate is the commit containing this section. Explicit per-agent Restart is implemented; named behavior profiles/applied instruction revisions are NOT implemented. This is a working lifecycle increment, not completion of the delegated profile journey.

Restart reuses the existing encrypted relay intent journal, per-slot assignment/CAS, operation reservation/receipt/outbox and Start/Stop ownership path. Captures selected inputs and fingerprints; checks local setup/key/executable/workspace before Stop. ACP prerequisite probe is identity-free and separately retained while the old run stays owned. Fully stopped probe, unchanged phase/fingerprint, complete old owned exit, cancellation recheck and final fingerprint precede fresh actual-run launch. Probe failure preserves the existing actual run; teardown uncertainty quarantines and retains handles. Valid Stop cancels queued/in-flight Restart; invalid authority, revision/body/previously-reserved ID cannot retract it. Save is serialized (after a successful Restart its old revision conflicts), never mixed into captured inputs. Assignment/root/grants remain untouched; no setup/key regeneration or schema rewrite. No promise of future provider/relay readiness from the independent prerequisite.

Executable acceptance: restart.test.ts real relay/host/external fixtures verifies same identity/assignment, new actual run ID, duplicate replay with byte-identical journal, deleted setup preserving running actual without recreating key, same-batch Stop, ACP rejection preserving old run, invalid Stop inertness and authorized Stop interrupting four-second preflight with no revival after its original completion time. slots.test.ts actual TUI now runs Restart X while X/Y both run; X gets a new run, Y's complete receipt/revision/run journal remains byte-identical. These are fixture proofs, not actual applied behavior instructions or installed conversation Restart.

Final executable strict passes; installed-enabled default npm test 35/35, no skips/failures, natural exit, 29.32s. Earlier increment default full 34/34 30.55s; then targeted Restart/slots 6/6 17.99s. No serial invocation in this continuation, no changed test script/global timeout/ESRCH assertion, and no failed test attempts. Self-review added retention of failed probe teardown and a phase fence so heartbeat quarantine during preflight cannot be overwritten by a new launch. Binary hashes separately rechecked and match the prior pins. Evidence: WORK_LOGS/BEEHIVE_DESIGN_183FFAF0/RESTART_DAD771/ (workspace absolute prefix /Users/loganj/.buzz/) holds default-full, targeted, check-final, default-final logs and installed hashes. No fresh dependency install was needed; lock unchanged.

Consumed fresh independent CONVERSATION_MOVE_REVIEW_A235638E.md: no new blocking Move defect, M1 resolved through original-derived reproduction plus postacceptance restart sibling; independent default concurrent 33/33 (31.956s), additive installed Move 2/2 (26.987s), grant-time positive PID/ESRCH and exactly one pregrant source AUTH. This review covers a235638 Move, not the new Restart delta. Prior concurrent broker failure at 1990.69ms remains historically unclassified: original log has no stack/final summary. Neither reviewer nor current default green runs classify/fix it. Previous serial 33/33 150.15s remains valid only for its stated older serial mode.

ONE next executable action: implement the remote nonsecret named behavior-profile owner and revisioned selected-next/applied-instruction snapshot, then extend the existing two-agent TUI Restart journey to prove actual instructions (not just labels). Do not treat this narrower increment as scope removal: named launch configurations, profile CRUD/use semantics, Restart lost-receipt/save-race/installed-conversation specific acceptance, local key/harness CRUD/guided setup, remaining Desktop harness/ provider/preset/custom/mesh/compute, final UX, production kind-40002/admission and normal service-user Databricks OAuth/live exact-model gate remain. Source-grounded matrix is retained in README and workspace HARNESS_PROVIDER_UX_GROUNDING.md.

Identity Move ff994 — executable completion checkpoint

Candidate is the commit containing this section; publication/remote head is recorded in the terminal result. Started clean published 97a9050adbabd09b868bdd55ce3af333c8ed0e9f. The previous fixture-only/circular exact-ready gate is removed, not relabelled ready.

Two gates at the host/broker owners: preflight checks locally provisioned same key, setup, selection, canonical executable/hash/script/workspace fingerprint; bounded identity-free installed runtime/CLI help checks and an independently owned ACP prerequisite greeting probe (no signer/relay/tools) complete and fully stop before prepared publication. Catalog fallback alone is never auth or readiness proof. Inventory labels prerequisite preparation separately from actual conversation readiness. After durable source exit/consumption/grant the target accepts once, freshly launches and requires the unchanged broker's exact model/session/response completion. Failure keeps target assignment and source revocation; no transfer of keys/workspace/session.

Observable acceptance: test/installed-move.test.ts uses TWO real host subprocesses, SAME fresh locally provisioned signer, actual installed buzz-acp and Buzz CLI, isolated actual conversation relay, deterministic existing ACP harness. Source answers first owner event; grant interception observes source stopped/consumed and source harness, TERM-resistant descendant and tool shim ESRCH BEFORE forwarding grant / target actual spawn. Target answers a second channel then a later turn in the first thread with canonical Schnorr signatures, exact channel/parent/non-owner member recipient, native CLI read/rejected-mention behavior and post-grant actual model/session evidence. Missing target setup, unsupported selection and rejected independent ACP preparation preserve the running source. Actual model rejection injected ONLY after grant leaves target assigned/stopped/null actual, no target reply, source Start denied. Source-Y byte-identical, cancellation, lost grant/receipt, historical/duplicate grant and source-restart evidence is reused from the full production Move suite, not re-created with a second signer in the installed conversation test.

Review consumed: MOVE_REVIEW_97A9050A.md M1 was blocking and is now fixed: existing preparation/grant-acceptance token cannot be replaced across replay/restart. Expired live readiness rejects preparation retry (new operation needed); exact original consumed grant still assigns target and leaves it stopped. Added changed-target-inputs

• graceful target restart + retained prepare-before-grant relay-history regression; original preparation deep-equal, duplicates inert and source remains denied across restart. Targeted Move/fixture 6/6 passed after this correction. This is author regression evidence, not a claimed independent re-review of the new delta.

Containment judgment: consumed reviewer source analysis and exact grant-delivery runner/ready TERM-resistant-child ESRCH probe. Current barrier is supported for exclusive live-anchor POSIX in-group execution, including separately broker-owned harness/tool groups and childless shim absence checks. Unknown/missing anchors remain fail closed; no numeric PID recovery grants kill authority. Historical old unrecorded PID cause remains unclassified. Reviewer separately captured empty PID bytes -> 0, not a live descendant. Fixture now awaits successful spawn, validates a positive PID and atomically publishes it before cancellation; absence assertion and bounded failure diagnostics unchanged. This is not arbitrary escaped-tree containment, physical-host proof, exactly-once/partition/clone/rollback safety. No broad historical stress campaign.

Validation: Node24.15.0, existing standalone dependencies/lock unchanged. First candidate strict + installed-enabled full 32/32 passed in 24.50s. After M1 and expanded negative acceptance, default concurrent full run recorded a broker failure and did not finish within the 90s tool deadline (no final summary; slots results absent). Its exact failure cause is unclassified, not silently called fixed. Targeted unchanged broker passed 1/1. Final exact executable state: strict passes; complete installed-enabled package with explicit --test-concurrency=1, no force-exit, 33/33, zero skips/failures, 150.15s. Serial validation avoids concurrent fixture contention, does not classify the failed concurrent invocation or establish default-concurrency reliability. No product sleep/deadline/absence assertion was weakened. Initial rejection-fixture iterations failed because fault injection at AUTH was too late (target harness already spawned); fault moved to pre-delivery grant interception, proving actual postgrant rejection.

Evidence: /Users/loganj/.buzz/WORK_LOGS/BEEHIVE_DESIGN_183FFAF0/IDENTITY_MOVE_FF994/ contains check/check-final, first full, failed concurrent final, final serial full, installed-targeted and M1-targeted logs; binary hashes freshly match existing runtime 10612d0025d1420bdd9e9afcc2e7129377da2414e75049a8b640e81d857441ea and CLI 147cc2ccf276ddedc5b84d13f5399a95282066303c9dca566bb2af5a37b856c5. Installed binary identity is separate from TS source identity. No actual Databricks, provider/login/community operations, production kind-40002 admission, owner private stores, Rust/native changes, repo-wide/GitHub CI, PR/merge/release or full parity claim.

ONE next executable action: independently review the published identity-conversation Move delta and its 33-test acceptance, focusing on prerequisite-probe ownership and fresh postgrant readiness (M1 reproduction is now a permanent regression). Then broader profiles/key CRUD/Restart/harness/provider/preset/mesh/compute/live UX scope remains as listed in README; normal service-user Databricks OAuth/model and production admission are separate real-user gates, not missing conversation Move engineering.

Identity Move continuation ff994 — recovered / design decision

Recovered clean 97a9050adbabd09b868bdd55ce3af333c8ed0e9f. Read current handoff/host/ACP/conversation/owned/supervisor and installed conversation fixture. The earlier “exact-ready preflight” rationale is superseded: preflight is local prerequisite validation, not future same-run readiness. Actual conversation readiness still belongs to the post-grant broker's exact model/session/completion evidence. No pre-grant identity-bearing conversation is permissible. Current implementation still blanket-refuses conversation Move; this entry does not claim acceptance. Production Stop uses a retained IPC group leader, self-group TERM/KILL and waits for group ESRCH; missing live anchor or unknown exit fails closed. Historical invalid fixture PID observations are not themselves a demonstrated barrier defect. Independent current transaction/barrier review is pending; no broad rerun campaign.

RECOVERED 9ff7 — executable fixture transaction, partial product handoff

Recovered actual HEAD and actual remote both at 8ba5fa9cd474aab5ce48fa255b194f8d3173aec1, with no prior transaction commit/push. Preserved dirty checkpoint/cli/host/intents/protocol and untracked handoff/move test. A RECOVERED entry was written before implementation or long validation. The commit containing this section is the new executable candidate (publication recorded in the terminal result). Historical sections below are superseded by this current state.

Recovered: source reservation, target preparation, source Stop, durable one-way consumed authority + exact grant/outbox, validated predecessor chain, idempotent target accept/fresh Start, TUI Move intent, three initial tests. New: validated Stop/Save before cancelling Move; exact pending Move retry republishes prepare rather than a terminal interrupted receipt; non-fixture/conversation Move explicitly refused before source effects because metadata preparation is not exact-model ready. Shared status, rows and retry confirmations now identify host + full agent + operation; Move includes endpoints. Source Start never resumes after consumption, including service restart. No source-validator relaxation without successor chain; no authority rollback.

Observable tests: actual two-host subprocess + actual TUI Move X leaves source Y's journal byte-identical; standby denied before grant; wrong target revision preserves running source; reverse successor rejects historical grant. Fault-injected relay loses grant and source receipt before receipt storage; inspect recovers outbox once. Target key deletion and prepared setup change after grant both leave target assigned stopped and source irrevocably denied, including after source service restart. Delayed prepared replies cover exact pending retry, valid Stop/Save cancellation, malformed Stop/unsupported Save inertness and late Start denial. Target admission failure here is not a claim of a live-provider launch failure or moved conversation response.

Consumed ASSIGNMENT_SLOTS_REVIEW_8BA5FA9C.md: F1 fixed, actual reopened two-agent same-host/action/revision blocked-operation TUI regression checks each row and retry confirmation. Declining either sends neither; immutable intent/receipt fences retained. Consumed RECOVERY_VERIFICATION_8A67B967.md findings remain closed, not pending.

Consumed new DESCENDANT_EXIT_EBC8B3CB.md report during this run. It reproduces the invalid fixture PID failure signature and reports group/member teardown probes green; historical raw PID/errno were not captured, so invalid PID versus PID reuse remains unproved. Containment gate remains OPEN, not cleared by these runs. At the exact reply-tool absence assertion, added raw PID, errno, spawn/error provenance and bounded per-PID state diagnostics on recurrence, retaining ESRCH requirement and no extra sleep. No owned.ts/supervisor teardown change or reconstructed PID kill authority. Existing live anchors remain the only teardown authority; stronger full-lifetime provenance and the historical observation still require reconciliation. Do not call this preview safe Move or an exactly-once/partition-safe transfer.

Validation evidence: WORK_LOGS/BEEHIVE_DESIGN_183FFAF0/MOVE_9FF7_EVIDENCE/. Recovered strict + Move 3/3 passed; new targeted TUI/Move 5/5 passed, expanded Move 4/4 passed. First candidate full installed-enabled 30/30, zero skips, 19.90s (check.log, full.log). Late self-review then corrected pending Move retry semantics; targeted 4/4 passed (pending-retry.log). Final-source strict/full 30/30 pass, zero skips, 19.12s (check-final.log, full-final.log). No failing executable run occurred in this recovery; earlier worker test history is unknown. Initial discovery directory scan timed out; no state mutation. Prior historical failing suite remains documented below. Installed binary hashes are separate from source identity; both freshly match the retained pins (installed-binaries.sha256).

ONE next executable action: run the instrumented installed-enabled full suite at this immutable candidate under the original contention configuration, retaining raw failure capture if it recurs, to reconcile the still-open source-exit observation before promoting fixture Move or implementing exact-ready conversation/provider Move. Do not repeat resolved slots-label or R1/U1 reviews. Broader gate also needs independent review of this new authority transaction; no installed moved-identity reply attempted.

Scope: dedicated trusted non-cloned/non-rollback installations/exclusive supervision; shared-owner signatures bind trusted protocol traffic, not physical host attestation. Root/assignment persists stopped. TUI sends intents only; hosts share existing management relay. No keys/workspaces/sessions/credentials transferred or regenerated, no unreachable-source takeover, new controller/registry/HTTP route, provider/login, production kind-40002/admission/OAuth proof, Rust/native or owner-store access. README parity matrix retains profiles/key CRUD/Restart/harness/provider/preset/mesh/ compute/real UI/live acceptance. No repo-wide CI, PR, merge or release claimed.

Move continuation 84e0 — implementation in progress

Starting exact published 8ba5fa9cd474aab5ce48fa255b194f8d3173aec1. Implementing per-slot durable reservation → target prepared → source exit → outgoing-consumed (grant and outbox in one journal write) → incoming-accepted → fresh ordinary Start. Genesis stays pinned; only prefix-extending validated grant lineage can replace initial-host authority. Preparation is not authority. Save/Stop invalidate an outstanding source reservation; post-grant failures never undo it. Next code path: host slot relay exchanges and immutable local preparation digest, then actual two-host execution tests and TUI destination selection. The descendant-exit report is not yet present at its supplied public path. Existing 25/25 is not resolution; final safe/conversation Move acceptance remains gated on that investigation and causal regression. No containment changes in this stage.

Slot continuation e0a5 — working single-installation slice

Started from verified published ebc8b3cb24fe0eefe5b8f239a88555786eadbf14. The candidate is the commit containing this checkpoint. One installation now owns ONE exclusion lock, owner identity, management WS connection and heartbeat. The existing admission/receipt/run state is an explicit in-process slot per persistent agent, not N daemons. Routing happens BEFORE operation-ID reservation/cancellation; queues, retractions, receipts, revisions, assignment and actual-run ownership remain per agent. Selected-next still never mutates actual-run. No validator relaxation.

src/slots.ts provides an explicit stopped migrate-slots upgrade: atomically replace setup.json with version-2 installation inventory (shared harness setups + agent keys/setup references), leaving the original journal byte-identical in place. No key generation, copied key, re-enrollment or wiped history. Legacy single-slot hosts remain supported without silent upgrade. Local add-agent creates a new key (or explicitly imports a matching public-root standby), reuses host-owned default harness, writes its inert per-agent journal before activating the manifest entry, and refuses partial leftovers. Maximum 32 slots. Shared auth/conversation setup is host-owned. Multiple selectable harness inventories and key/profile CRUD remain unfinished, not hidden remote setup APIs.

host.close attempts every slot via allSettled, preserving successful siblings' stopped truth while quarantining/reporting uncertain execution and retaining the single host lock. Shared management client reconciliation now queries every unresolved host/agent pair, not merely the last agent per host. All slots hydrate before dialing: initial relay history coalesced with socket open is accepted before the ready-promise continuation, rather than discarded. Existing receipt fingerprint, policy-blocked unchanged retry, admission cancellation and no late revival retained.

Production-bound test/slots.test.ts proves:

• ONE real host subprocess + ONE management socket hosts X,Y. Actual TUI subprocess selects exact numbered rows, Save/Start both, Stop X; ambiguous host-name shortcut rejected. Y's journal stays byte-identical across X Stop, including receipt, revision and actual run. Same operation ID on different slots is independent.
• Both delayed external ACP Starts enter transitioning concurrently with a shared operation ID. Stop X cancels X while Y remains pending and later completes. Replay returns their distinct terminal results without either journal changing.
• Wrong-agent/host operations cannot affect a run; actual host WS loss/recovery replays each slot truthfully; graceful service restart retains assignment and reports stopped instead of phantom live execution. Same-key standby elsewhere still cannot Start. No transfer or source-unreachable takeover.
• Explicit migration after real Start/Stop preserves revision, two operations, outbox and assignment byte-for-byte. Unknown first slot makes close fail/retain lock but does not skip teardown of a healthy running sibling.
• Actual management-client reopen/reconcile queries each unresolved slot; starting the real host later consumes initial relay history and resolves both intents.

Final executable candidate: strict TypeScript + installed-enabled full package 25/25 pass, zero skips, 17.29s. Logs in workspace WORK_LOGS/BEEHIVE_DESIGN_183FFAF0/SLOTS_E0A5_EVIDENCE/{check.log,full.log}. Single-process proof logged public identities d2c1dbd61931eed22800b45de0cf422bd3f5e70b7585ec6f789e8124f2f21a9e and ab3c21202f172cbc9d5ae1e07d5d0021ed9a34c1d56130af24124220c3df8e83. Installed binaries freshly rehashed, both match retained pins below. Existing installed signed three-conversation seam also passed; slots themselves use external lifecycle/ACP fixtures, not simultaneous live-provider conversations.

Iteration failures retained honestly: the new TUI test initially timed out (twice, one instrumented) because the test driver assumed a prompt ended a stdout chunk; async status coalesced after it. Fixed the driver to consume prompt positions, no product wait/sleep or assertion weakened. New reconciliation test then exposed initial-history loss (one failure plus diagnostic confirmation); fixed at host hydration/connection owner. These are distinct from the earlier unresolved reply-tool.test.ts:68 descendant observation. No containment code/assertion changed; this 25/25 pass does NOT resolve that observation or prove Move-safe exit.

Consumed independent RECOVERY_VERIFICATION_8A67B967.md: old frozen R1/U1 both verified fixed, original replay reproducer and conflict/later-run controls green, actual TUI byte-identical once-only retry/outbox recovery green, strict + installed 19/19. This closes the old recovery review, not new slots review or descendant exit. The separate bounded descendant investigator has not delivered its causal report at this checkpoint. Trusted non-cloned/non-rollback installations and exclusive supervision remain assumptions; shared-owner signatures are not host attestation.

Move is NOT implemented and remains gated. ONE next executable action: consume the bounded descendant-exit report and bind its causal finding (or remaining probe) to the actual owned-containment seam before implementing the source-consumed Move transaction below: target preflight, complete owned source exit, atomic one-way revocation/exact grant+outbox, idempotent target accept/fresh launch. No initial-host validator relaxation, timeout resurrection, key/workspace/session transfer or new controller/HTTP lifecycle service. Request independent immutable slot UX/correctness review alongside that continuation; do not repeat closed old R1/U1 review.

Full remaining parity stays in README: Restart, profiles/keys/metadata/history, selectable harness/provider/preset/mesh/compute inventory, live model/admission, retention and recovery. No owner credential/profile/OAuth reads, production/native or Rust edits, full repo CI/GitHub CI, PR, merge or release. Publication uses existing approved GitHub branch, configured Logan Johnson author/committer + DCO, no invented cryptographic signer.

Assignment foundation handoff — delegated fb23e116

Governing boundary: key possession is not assignment. Provisioning must create a public pinned genesis (owner, agent, initial host, random enrollment ID) and an explicit durable per-agent assignment before any host can Start. Host startup must never recreate a missing authority journal. Existing journals require explicit local stopped-state migration, not implicit re-enrollment. Import attaches to an existing public genesis and cannot root authority at the importing installation. Dedicated non-cloned/non-rollback installations and trusted one-time local enrollment remain assumptions; shared-owner signatures are not physical-host attestation.

Planned transaction successor (NOT implemented): reserve exact source revision and immutable target inputs; relay target preflight; confirm all source owned groups absent; atomically consume source authority plus exact destination grant/outbox; accept once at destination before fresh launch. No timeout/receipt loss rolls back a grant. Unreachable source blocks transfer even when last observed stopped.

Implemented bootstrap fence in src/assignment.ts and src/host.ts: new local provisioning pins explicit initial authority; startup cannot recreate missing journals; explicit lock-protected stopped legacy migration preserves history. CLI standby import binds the existing public root and identical locally provisioned key; root export never exports keys. Host admission and early Stop cancellation both check durable assignment. Source Stop/restart preserves assignment. Local key absence blocks future Start without restoring hydrated keys; Stop stays available.

TUI inventory now keys by host AND agent, groups identities with agents, and offers numbered exact host/agent selection plus backward-compatible unique-host selection. assignment.test.ts uses THREE distinct real TS host processes on one isolated WS relay: source/standby share X; a third installation holds Y. Two identities run under separate assignments and actual TUI subprocess selection shows both. Standby and cross-agent Starts fail, source restart retains assignment, unreachable source cannot authorize standby, deleted setup stays deleted, missing journals/migration fail closed. This is not multiple slots on one host, nor an actual transfer. No duplicate daemon directories are presented as slots. No Move protocol/interface stub is exposed.

Validation: strict TypeScript passed. Full installed-enabled package suite repeated on unchanged executable candidate: 21/21 passed, zero skips, 16.72s. First full run was 20/21: existing reply-tool.test.ts:68 observed a descendant PID still present after group Stop; isolated rerun passed and subsequent full run passed. No test was weakened and no containment implementation changed. That intermittent observation is unresolved, not claimed fixed; retain it for investigation before Move exit proof. Both installed executable hashes freshly match retained pins. Evidence directory: WORK_LOGS/BEEHIVE_DESIGN_183FFAF0/ASSIGNMENT_FB23_EVIDENCE/ contains check.log, full.log (failure), check-final.log, and full-repeat.log (21/21). Existing installed signed-conversation tests passed, but this new assignment test is lifecycle fixture only; no destination conversation or live provider acceptance is claimed.

Move and multi-agent slots on one installation remain gated. The current validator intentionally requires assignedHost == genesis.initialHost; do not merely relax it to simulate Move. Replace it with verified consumed-predecessor/grant-chain authority only when source revocation, outbox and target acceptance are implemented together. One dedicated owner scopes this development protocol; IDs route trusted installations, not independent host attestation or production-community enrollment. No timestamp, TTL, election, direct HTTP lifecycle route, remote secret or automatic takeover added.

ONE next executable action: introduce per-agent slots under ONE installation lock and ONE management connection, preserving this bootstrap fence and receipt/admission state per slot; prove X and Y coexist before building the source-consumed Move transaction specified above. Then implement preflight/exit/grant/accept/fresh launch and failure/replay tests, including investigation of the intermittent descendant observation. Do not treat this prerequisite candidate as completed two-host Move. Remaining profiles/key CRUD/Restart, richer setup/provider/preset/mesh/compute parity, real UI/live auth acceptance, retention and trusted-scope recovery remain in README. No production services, owner stores, OAuth/provider access, Rust/native edits, repo-wide/GitHub CI, PR, merge or release. Author/committer Logan Johnson + DCO verified; no cryptographic signer configured.

Published continuation 4341 — U1 policy recovery

UX source committed/pushed as 4fa4fd146961f91fdace04f3c6fb59e6300e2473; exact origin head and clean worktree verified after push. This documentation-only follow-up records that immutable tested source head.

R1 was separately committed and pushed as 64305a7a0020da0faa599b46be37b538b9533945; origin branch verified at that exact head before this UX checkpoint. No reset/reimplementation or additional writer.

TUI now offers numbered operations, reconcile, and informed retry <number>. Reconcile explicitly reconnects, reads relay history and queries host outbox via existing inspect messages; it does not replay blocked work or assert policy repair. Host inspect republishes durable terminal receipts so a receipt lost before relay storage remains recoverable. Retry sends the original retained envelope ONCE with unchanged ID/signature/ciphertext/body/fingerprint/revision. The durable policy block is deliberately NOT removed: socket success does not authorize blind future retry. Only a matched terminal receipt resolves pending work. Completed/known rejection/ UNKNOWN remain distinct, historical results are labelled separately from current host inventory, and the confirmation explains policy repair, uncertain prior effect, permanently invalid events and no remote cancellation. Repeated 1008 remains blocked. No replacement ACK/control service, re-signing or host-precondition change.

Acceptance is actual TUI subprocess, real package client/relay/host, fresh keys and fixture runner, with test-owned loopback WS fault placement (not a model or production policy test):

• Policy denial before Stop publication -> explicit retry under continued denial -> two denials total; correction/reopen sends zero blocked commands; reconcile sends zero blocked commands; numbered confirmed retry completes original Stop once. Three total attempts all byte-identical, one Start plus original Stop in host operations, final stopped/revision2.
• Committed Stop receipt dropped BEFORE relay storage -> 1008 block -> corrected reopen queries host outbox and recovers original accepted result without a second Stop attempt. Final revision2; completed entries reject further retry.
• Reconcile after completion does not duplicate effects. Intentional Quit in each subprocess exits 0 with independent-host-lifetime message, no spurious UNKNOWN.
• Existing lost-Start/crash/receipt negatives and installed cross-conversation seams remain green; predecessor independent seven crypto/receipt/perms negatives reused.

Final semantic candidate: strict TypeScript + full installed-enabled package suite 19/19 pass, zero skips, 15.64s. Evidence in workspace WORK_LOGS/BEEHIVE_DESIGN_183FFAF0/CONTINUATION_4341_EVIDENCE/ux-check.log and ux-full.log; production-bound regression source test/policy-tui.test.ts. Binary hashes freshly rechecked and match the two pins below. No dependency changes. No repo-wide just ci, GitHub CI approval, production admission, real provider/OAuth, PR/merge/release, or full delivery claim. Tested source is the immutable 4fa4fd146961f91fdace04f3c6fb59e6300e2473 listed above; the following checkpoint-only commit does not change executable source. Configured Logan Johnson author/committer + DCO verified before push; no crypto signer.

Completed independent TOOLS_RECONNECT and INTENT_TUI reviews are consumed. The new UX delta has self-review and executable acceptance, not yet a separate immutable independent review. This is not a reason to leave the broader build waiting. ONE next executable step: implement conservative same-identity two-host assignment / Move with multi-host/agent selection, preserving remote-only normal configuration and lifecycle and refusing unreachable-host takeover. Retention1000/pruning, profiles/key lifecycle/Restart, broader harness parity and live-production gates remain unfinished.

Continuation 4341 — R1 reconciliation

Recovered d12ed7b4e0 plus the prior worker's uncommitted host/TESTING/admission-cancel changes. Fresh substantive review found an additional pending-ID gap: a same-batch Stop reusing the queued Start's ID could retract admission although its own eventual receipt was operation-id-conflict. Receive-order reservations now fence that early authority, alongside durable IDs, agent/host/revision/body checks. Added conflicting-ID and invalid-body batch controls. Executing ACP cancellation may surface ACP session unavailable; after verified teardown the receipt now consistently names concurrent Stop cancellation. No sleeps, replay exception, stale-revision bypass or changed command preconditions. FIFO Stop handling clears its retraction before future Starts; terminal historical IDs cannot retract again. Close drops not-yet-handled messages (UNKNOWN, replayable) and awaits executing admission/owned teardown; no new close semantics claimed.

Fresh strict TypeScript and full installed-enabled package suite 18/18 passed on this candidate (Node24.15.0). Exact log: WORK_LOGS/BEEHIVE_DESIGN_183FFAF0/CONTINUATION_4341_EVIDENCE/r1-full.log. One initial targeted run exposed the cancellation wording variation above, corrected before this full run. Source R1 checkpoint is the commit containing this section; publication/head will be recorded in the next UX checkpoint.

Completed independent INTENT_TUI_REVIEW_D12ED7B4.md is consumed: strict16/16, 36-file byte match, seven receipt negatives, real PTY lost-Start recovery and safe Quit; no additional blocking journal correctness defect in trusted non-cloned / non-rollback scope. U1 is a concrete policy-correction recovery UX gate, NOT pending review: implement supported reconcile and explicit unchanged retry next. Earlier pending-review/future-recovery notes below are historical, superseded here.

Local management-client journal continuation 90950bdd

Started verified published HEAD 6f893f51d20d93ff25770b66f3b52b50bcff151e. src/intents.ts is LOCAL TUI/client state, not a controller process/service. No dependency, private-host-key, ordinary conversation permission or runtime change. TUI automatically creates owner-only management-intents/<relay+owner digest>/ beside the existing operator identity. Each submitted operation is encrypted/signed ONCE, fsynced with an exclusive immutable intent file before any send, and replayed on bounded WS reconnect or ordinary reopen. A duplicate operation ID cannot prepare a replacement. Receipts are encrypted in separate exclusive files; stale publication observations cannot erase a terminal result. 1,000 intents maximum; no pruning yet.

Host receipts now include the existing request fingerprint. Matching requires the actual owner decryption/signature, exact relay journal scope, host, agent, operation ID and fingerprint. Host outbox/operations remain lifecycle truth; no second admission model. Relay echo is publication evidence, not host admission/completion. The UI shows pending/completed/failed/unknown, with operations for retained details, and prints host/action/result rather than requiring operation IDs. Quit cancels transport reconnect only; it never cancels an operation or stops a host. Save remains selected-next.

test/intents.test.ts proves actual socket loss before publication, reopen applying the original Start once, retained terminal results, unrelated/duplicate receipts not closing another intent, permanent host rejection, and relay-side socket termination when delivering a Stop receipt AFTER the host journal has committed stopped. Automatic client reconnect recovers that receipt. A separate actual Node subprocess exits 23 without running the network event loop or graceful close after preparing an intent; reopen publishes byte-identical envelope, verified against the relay's stored log. Tampered signature fails closed. Relay policy close 1008 remains UNKNOWN and durably blocks blind automatic replay across reopen; no fabricated host failure. Normal network loss retries eight times; exhausted/offline pending work remains durable. File writes propagate errors instead of being swallowed as malformed network input.

Evidence: strict TypeScript + full installed-enabled package suite 16/16 passed. After human-readable connection/status display refinement, strict + targeted real TUI/client suites 5/5 passed; final source strict + full default suite 15 pass / 1 installed opt-in skip passed (the unchanged installed path was not repeated). Prior installed runtime evidence retained; this run also produced three verified fixture replies from agent b727bb8ae1e277a522f8dbad00aae15cc7b71e39c57d43e7f5d532529e8087aa. No real provider/admission calls, production activity, full repo CI or PR/merge/release. Completed preceding broad-tool/reconnect review is consumed in continuation 4341 above. Existing B1/D1-D3 conclusions retained, not reopened or treated as approval of this new journal delta.

Limits: relay URL is the community scope in this development topology, not a stable production community identifier. Publication echo observation is session-local; terminal host results persist. There is no relay per-event rejection/ACK protocol: policy failure is conservatively UNKNOWN/blocked, not claimed failed; guided recovery is now implemented in continuation 4341; journal retention remains future work. Pre-upgrade host receipts lack fingerprints and cannot complete new journal intents. Arbitrary disk rollback, malicious local operator, simultaneous UI action coordination, log-full recovery and host SIGKILL recovery are not proved. Single-operation exclusive files prevent conflicting-ID replacement and receipt overwrite, not distributed UI serialization. Crash test is process exit without cleanup, not machine power-loss proof. Stop-during-Start remains covered by unchanged full-suite regressions; no claim that this new test automates the entire interactive crash workflow.

Historical next step (completed in continuation 4341): independent journal review and real TUI policy-recovery acceptance. Current next step is two-host assignment/Move. Full remaining parity scope below remains active, not declared complete.

Recovery 4200a3ab

Recovered clean HEAD f8f161ffc10f274e13b9e1cd984ca8ffc2897cfd, not 023c9274767ef50fa0f5b37ef1883336f8be59fd: the interrupted worker had already committed the multi-conversation/tool slice and its checkpoint. No untracked source or pending diffs survived. Remote branch lookup returned no ref and GitHub PR lookup for this branch returned []; no previous push/PR found. All six task commits retain Logan Johnson author/committer and DCO. Recovery preserves that implementation rather than repeating it. Fresh recovery validation passed strict TypeScript and the installed-enabled full suite 12/12 on that source HEAD. Rehashed binaries match the pins below. Fresh signed reply IDs were 4629e63f8e838101943e41ab056c37610371f288ac51d63a0e3c3120c857b05f, e836d1d91e6cf93ae81fe4321071b95543bfc34fc5a5ee287eec7f1a1fdb3d01, 90389c57ba6f33f4443cbb77cd7352c0ad1133f58da1f0741216f5d78a0a29a0, all from agent ea79535a7d50890ba23bbc960ffd780acecd31f9c9a1dd975dd0d7fbbac419f8. No recovered PID was used for cleanup and no private run artifacts were read.

New implementation commit 998e919a9b26af0ec3b15eefba539661380eeed7 was pushed successfully as the first publication of beehive/cbfd9440 to https://github.com/block/buzz.git. This checkpoint-only follow-up retains that source. No GitHub or NIP-34 PR has been created; repo-wide just ci remains outstanding; subsequent independent reviews are consumed in continuation 4341. buzz pr open --help requires a NIP-34 repository owner pubkey/id; neither was inferred from GitHub ownership. Any later Buzz PR must carry channel f45d3304-dcf0-44e8-a46d-bcd63b235fbc.

New continuation: host management transport recovery

client.ts now supports opt-in bounded reconnect (eight attempts per lifetime, 100ms exponential backoff capped at 2s, 2s handshake deadline). Initial connection failure still rejects readiness and unwinds the host lock; intentional close cancels pending retries. Only the host opts in: TUI reconnection and durable controller intent/ACK tracking are NOT implemented by this change. Exhaustion leaves management disconnected; host lifetime/ownership remain independent.

The host replays durable receipts and publishes fresh inventory on reconnect. Replayed relay command history still passes through the existing operation-ID, fingerprint and revision guards. reconnect.test.ts drops the actual host socket, publishes Start while disconnected, observes acceptance after automatic replay, drops the socket again after commit, and verifies the identical receipt, actual run and single revision/operation survive. Stop still tears down the owned run; intentional host/client close cannot reconnect. This proves relay-persisted intent recovery, not recovery of controller intent that never reached the relay. The existing receipt outbox is retained, not ACK-pruned. No protocol change or new remote/local lifecycle endpoint. This delta subsequently received TOOLS_RECONNECT review; R1 is resolved above.

Implemented: ordinary multi-conversation Buzz CLI tool authority

Host -> installed buzz-acp -> childless ACP shim -> separately host-owned ACP harness -> childless MCP shim -> host-resident TypeScript MCP adapter -> separately host-owned installed Buzz CLI. No second chat/agent runtime; no Rust/client edits.

conversation-setup optionally provisions only a canonical installed Buzz CLI executable. buzz({argv, stdin}) exposes its native command contract to the model, including native help. No local channel/parent/recipient grants and no prompt scraping in the host. One persistent agent can answer different conversations without another host-admin step. Old single-thread setup objects are explicitly rejected with reprovisioning guidance, never silently widened. Executable path/hash, agent signer, relay and optional attestation remain host-owned snapshots. Caller executable/env/shell/MCP provisioning and identity/relay/attestation flag overrides are rejected. Normal CLI file operations have local service-process authority; this adapter is not an OS filesystem sandbox or a shell tool.

Short source-driven comparison / authority choice

• Desktop managed_agents/runtime.rs:290 selects canonical MCP; :574 injects the agent private key and relay; :708 injects optional owner attestation.
• buzz-acp/src/lib.rs:5894 builds MCP with that agent signer/relay/attestation. pool.rs:1732 adds git hints, not authoritative per-turn permission metadata.
• buzz-dev-mcp/src/lib.rs:168 delegates its buzz personality to the existing CLI.
• buzz-acp/src/queue.rs:1380–1407 renders ordinary reply guidance and explicitly permits requested channel-root posts. It does NOT mint a per-turn scope grant.
• buzz-cli/src/commands/messages.rs:611–680 owns explicit/implicit mention resolution, member checks, immediate-parent/root lookup and publication.
• buzz-cli/src/lib.rs:78–106 identifies relay/private-key/auth-tag override flags; the adapter rejects these while preserving normal command arguments.

Choice: reuse the CLI/runtime as destination/thread owner and relay membership / agent authentication / optional attestation as permission authority, not a second controller. Owner-only inbound dispatch remains unchanged. Outgoing mentions need not be restricted to the owner when other channel participants are authorized. No permissions are manufactured from untrusted model prompt prose. The fixture model interprets upstream instructions only to choose tool arguments, as a model would; that is not a host authorization decision.

Process ownership and model evidence preserved

Upstream buzz-agent/src/mcp.rs:758 and buzz-dev-mcp/src/shell.rs:677 deliberately detach process groups. Only childless shims may escape here; actual harness and CLI launches use separately retained spawnOwned anchors. Stop/cancel/disconnect/ failed startup retain and await teardown, including TERM-resistant descendants. No recovered numeric PID confers kill authority. Resource limits bound sockets, requests, frames, calls, output and deadlines. Current per-connection request and per-run shim/session caps still require future long-running recovery work.

Tool stdout is bounded UTF-8 and returned after anchored cleanup/drain, so reads are useful. Stderr is withheld. A normal CLI nonzero exit becomes MCP isError, not fatal conversation teardown; model can correct a failed member/argument request. Containment/protocol errors still fail closed. Exact-model same-session acknowledgement, model-before-prompt, malformed-tail fences and actual completed response proof remain.

B1 from independent BROKER_REVIEW_C4F30176.md was fixed in the predecessor: optional config rejection is followed by exact-model re-ack BEFORE forwarding the original error. Existing accepted/rejected optional config, failed re-ack and model-changing rejection regressions remain green. Consumed independent TOOL_REVIEW_023C9274.md (workspace WORK_LOGS/BEEHIVE_DESIGN_183FFAF0/): no new high-confidence blocking defect, B1 resolved through original/extended independent probes; strict/full12/12 and independently verified installed signed publication. Its retained invariants are host executable/env/key/relay ownership, childless shims, exact-model fencing, distinct tool/ACP/publication evidence and bounded resources. This ordinary-CLI delta subsequently received TOOLS_RECONNECT independent review. Long-lived request/session cap recovery remains explicit subsequent work, not general MCP compatibility.

Observable installed isolated outcome

Actual installed binaries (read-only, freshly rehashed):

• /Applications/Buzz.app/Contents/MacOS/buzz-acp SHA256 10612d0025d1420bdd9e9afcc2e7129377da2414e75049a8b640e81d857441ea
• /Applications/Buzz.app/Contents/MacOS/buzz SHA256 147cc2ccf276ddedc5b84d13f5399a95282066303c9dca566bb2af5a37b856c5

installed-conversation.test.ts provisions fresh fixture credentials once, starts one installed runtime and uses two authorized channels/threads, then a later owner prompt in the first thread. All three actual CLI-published replies have canonical hashes, valid Schnorr signatures, the SAME provisioned agent pubkey, expected channel/parent, and explicit non-owner member recipient. Later reply references the later owner event, which itself references the original root. The installed legacy CLI emits an immediate-parent e reply tag only; it does not duplicate the root tag (unlike the current source contract). Three native channels list reads return useful channel data. Non-member mentions fail without publication; a member who is not the configured owner cannot trigger a reply. Harness model/session checks occur before every prompt. The broker remains healthy after the later turns; owned Stop removes harnesses, shims and resistant descendants. Test code never manufactures the agent reply. No reconfiguration or new agent key between prompts.

One full-suite replay observed agent 9aa6385895b9b03438af14e5ede3f947c0e3d71e2eb378b923dd571aec770a26 and replies 591297eb4f81d62656c896e7ee4e2b391d5cf971e3790cb6675533113e7ca746, 8de7f8c4b4d15f6edbff7a7ad24cf9f78eb4ac70997bea118435cf197b25fef5, 81f42e7f3a5ed59c151d5152159b30e729eb72cad64b4dd502864ae91680bb41. These are disposable loopback fixture events, not production relay links.

Fixture model remains a fixture. This is installed runtime/CLI execution with legacy kind-9 NIP-42/NIP-29 fixture evidence, NOT current production kind-40002, real admission, provider/OAuth or Databricks evidence. Explicit hex mentions are validated; unresolved implicit display-name mentions are NOT claimed to work. Recovery also ran the installed CLI's messages send --help under empty env: --mention <MENTIONS> supports hex or npub and is repeatable. Only hex was exercised by the integration.

Validation

Hermit Node24.15.0 / pnpm11.4.0; standalone registry-agnostic lock unchanged. Predecessor fresh-store frozen install fetched all seven locked packages from the approved mirror. No dependencies, global config changes or borrowed modules added.

. ./bin/activate-hermit
cd beehive
npm run check
BEEHIVE_REAL_BUZZ_ACP=/Applications/Buzz.app/Contents/MacOS/buzz-acp npm test

Recovered source strict/full 12/12 passed, followed by strict TS and complete installed-enabled package suite 14/14 on the new reconnect candidate before commit; diff check passes. The new run observed agent bf96b3237352b2038eb98b7907a5bc9a6927ce053c63b4fa4c7a6ac9ed53cb71 and replies 94382d6dc7fb2174455f8f88d23a2eccedef9e2e6f4b390ec9e3ada278d6a88b, f2842a378f033c62437ec7bb4662c19e37c8b9f490dfa8e56849ef16f23732c8, 3db6e28555bfc0f940bfc63d877b7157a662bdda702225fed20e77be12e485c6. The source candidate is the commit containing this recovery checkpoint. Self-review added legacy-scope opt-in migration, UTF-8/drain correctness and explicit relay/attestation/env override negatives. No repo-wide just ci, production operations, owner credential/profile reads or live provider calls. Configured Logan Johnson author/committer and DCO retained; no cryptographic signing key configured, so no invented signer/signature claim.

Remaining product scope / ONE next executable step

Next: conservative same-identity two-host assignment/Move and multi-host/agent selection. Journal and multi-tool/reconnect independent reviews are completed and consumed above; R1 and U1 corrections have executable acceptance. The bounded journal is not full recovery/parity completion.

README retains the full parity matrix: reconnect/ACKs/crash recovery; multiple hosts/agents/setups and S1 two-host identity; reusable profiles/metadata/history; key import/revocation; Restart/Move; other Desktop harness/provider/preset/relay- mesh/compute support and final independent real UI review. None is excluded. Production admission/protocol and named-service-user normal Databricks v2 OAuth / live model remain unproven. The later live gate requires exact named-service-user local auth and necessary community admission, not replacement of missing engineering. Dedicated management TS relay remains explicit; no hidden privileged lifecycle API. Selected-next != actual-run; stopped identity remains assigned. No remote secrets, credential/workspace/session transfer or unreachable-host takeover. Hash/spawn TOCTOU, hostile journals, rollback/clones, outbox pruning and stronger OS containment remain outside evidence.

928F final validation/publication record

Final executable tree: strict passes (K1_928F/final-strict.log). Exactly one final FULL DEFAULT concurrent installed-enabled package run naturally completed: 50/51, 1 failure, no skips/cancellations, 35.322s (full-installed-default.log). All six key-removal/import tests passed, including actual CLI K1 negatives, real Move and hidden-input macOS PTY. Failure: slots.test.ts:131 waiting for standby host Host online via launch:50; stderr is discarded by that existing test driver. Cause remains unclassified. No serial masking, rerun-to-green, timeout inflation, assertion weakening or claim of full-suite acceptance. Prior four 110s timeouts and other historical failures above remain independently scoped and unclassified except for the specifically traced private-journal/TUI observation revision race.

Self-review checked common retained-state loader extraction, exact key matching, no import authority synthesis, key input/output boundaries, atomic manifest-only writes and stopped/lock gates. macOS PTY adapter failures and strict extraction failure are retained alongside successful focused runs. Installed binaries were read-only and hashed separately: buzz-acp 10612d0025d1420bdd9e9afcc2e7129377da2414e75049a8b640e81d857441ea, buzz CLI 147cc2ccf276ddedc5b84d13f5399a95282066303c9dca566bb2af5a37b856c5. These are installed runtime + deterministic ACP/loopback fixtures, NOT live provider, OAuth, production kind-40002 or full-product parity evidence. No dependency changes. Source hashes and publication verification live beside the logs; the final source commit is the commit containing this section. Required author/committer Logan Johnson loganj@squareup.com, DCO, no cryptographic signing claim. No repo-wide CI, merge or release. Remaining second-phase work and full-suite failure investigation are explicit handoff items, not closed by this partial key-import tracer.

0346 pre-final gate

Strict + one focused disconnect/Goose CLI run passed 3/3, natural 6.190s. The disconnect trace asserts actual handler-installed → handler-entered → term-written, same positive descendant and cwd; unchanged group ESRCH passed. This falsifies neither the historical missing-marker event nor older timeouts. Final source adds successful trace output to the test log for inspection; no clock-order correctness assertion (wall clocks are diagnostic, not authority). Next command is strict + FULL DEFAULT concurrent installed-enabled exactly once; no concurrent reviewer full suite, serial mode, retry or deadline change.

Claude/Codex 6f8d — early source constraints

Pinned source 051c3a270b read via git show in buzz-reference, not its working checkout. discovery/catalog.rs:50–119 requires distinct vendor CLI + zero-argument ACP adapters, disables unstable model switching/native config for BOTH. Claude uses ANTHROPIC_MODEL alone (claude_config/mod.rs:1–27); native profile transport is gated by exact @agentclientprotocol/claude-agent-acp initialize identity, then _meta.systemPrompt.append (buzz-acp pool.rs:287–320, acp.rs:636–668). Codex is not Goose: catalog model/provider env mappings are absent and native profile support depends on negotiated protocol (pool.rs:315–320). No invented Goose extension or set_model acknowledgement will be used for these adapters.

Implementation begins with Claude's source-supported startup-model/native-profile path; Codex remains explicitly unfinished unless its stricter proof fits. Service HOME and local Claude credential input must not become relay fields; executable presence is never authentication. Existing wizard/immutable bindings/host/broker owners will be reused, not a diagnostic runtime. No executable changes yet at this early checkpoint. NORMAL_REVIEW_425FEB34 is independently CLOSED (6/6 and strict/authority negatives), not pending. Historical broker/tool 71/73 failures remain unclassified by the baseline green 78/78.

Claude 6f8d — executable progress before full gate

Claude API-key-only path is now implemented in existing setup/local-setup, immutable bindings, host AgentSession and actual conversation broker. New claude.ts validates dedicated service HOME context, canonical vendor CLI, owner-only service-user key file, closed ANTHROPIC_API_KEY/ANTHROPIC_MODEL env; no ambient provider env, login, status subprocess or universal credential form. Local credential presence remains unverified. Startup requires actual session currentModelId plus advertised exact model; missing report fails closed rather than sending invented set_model. Exact package identity gates native profile _meta.systemPrompt.append. Claude load/resume/config switching deliberately fail closed; native settings are not advertised by pinned source. Existing Buzz Agent optional-config/re-ack and Goose handling are unchanged.

Actual NORMAL_A661/RECOVERY_5360 journey reused/parameterized, not bypassed: Claude initial normal wizard → actual host CLI → installed buzz-acp and Buzz CLI → actual TUI Start/Restart: PASS, four signed same-identity replies, two channels, fresh session/profile/model, unchanged sibling/history. Selected diagnostic B → normal immutable conversion → same installed service/TUI journey also PASS, four signed replies. Wrong model, missing native capability, adapter auth rejection and missing private key file preserve the actual run; Stop still works with that file removed. Fixture validates private env and public inventory excludes private inputs.

Standalone Claude production-bound ACP/private-env tests PASS 6/6, including drift and owned descendant ESRCH. Two strict iterations found test/code narrowing errors (one overly broad textual insertion corrected, one union field assertion narrowing being corrected); raw logs retained. No full suite run yet. Evidence directory WORK_LOGS/BEEHIVE_DESIGN_183FFAF0/CLAUDE_6F8D. Adapter/vendor are deterministic TS protocol fixture / Node placeholder, NOT installed Claude. Only buzz-acp/Buzz CLI are real installed binaries. No real provider calls. Codex remains UNIMPLEMENTED; source says no model env mapping/no native config, protocol-dependent profile transport and distinct auth/config context. Do not relabel Goose or Claude as Codex.

Binding replacement/retirement 1bc0 — implemented candidate before final full gate

Code checkpoint 9f6d88569 added local replace-binding/retire-binding, separate manifest retirement fingerprints, stopped startup-lock atomic write and host execution/Save eligibility gates. Follow-up adds affected-state confirmation fencing, truthful inventory/TUI availability, and production-bound tests at existing owners. Immutable Setup hashes, original definitions, keys, selected configurations, journals and Move authority are never rewritten by local retirement/replacement. Reopened retired selection is unavailable without fallback; Stop/rename/remove remain credential-neutral. Consumed grant acceptance still precedes launch checks. No physical history pruning, automatic Restart/selection, stale-lock deletion or standby Start permission. Replacement deliberately reuses the same provider contract, service context and pinned conversation authority; changing provider credentials or expanding the provider schema is not part of this action.

Focused strict passes; bindings/recovery 7/7, natural 12.754s. Existing installed normal journeys with replacement: 6/6, natural 133.413s. Self-reviewed the atomic writer, integrity versus eligibility split and unchanged consumed Move ordering. Final strict and ONE default concurrent installed-enabled full run are next at this committed candidate. Raw logs/results live outside source in workspace WORK_LOGS/BEEHIVE_DESIGN_183FFAF0/BINDING_1BC0 (final result recorded there, not an untested subsequent source edit). No repository CI or real provider approval; historical broker/tool failures remain unclassified by these focused passes.

Preset/custom ACP 8d6d — CODE checkpoint before integration gates

Implemented process-free ten-preset discovery from pinned 051c3a2 definitions, local wizard immutable diagnostic registration, and owner-only structured custom JSON input. Presets are setup/diagnostic-only: no exact actual-session model/native profile contract established by their source; NotApplicable is NOT authenticated. No configured argv is shell-interpreted or comma-split. Custom normal entry opts explicitly into the existing Goose-native contract owner (identity/configOptions/ native profile extension), not arbitrary protocol2/systemPrompt. No new runtime, auth registry or remote env editor. New/replacement/retirement remain under existing immutable binding/startup-lock ownership; diagnostic definitions advertise no models. Implementation exists; strict passes; user-shaped installed validation still pending. Closed Codex/Claude/NORMAL/CLI reviews remain closed in their prior scopes; historical broker/tool failures remain unclassified. Full remaining provider/mesh/compute and live-vendor gaps are not narrowed by source-shaped fixture claims.

Recovery fcd99859 — recovered CODE, next executable step

Recovered HEAD 811ba471d2 (one local preset commit after published 8bf1c7d9), plus ten modified TS files, custom-acp.test.ts and PRESET_CUSTOM_SOURCE_8D6D.md. Preserved all work. Surviving public PRESET_CUSTOM_8D6D logs show strict iteration 8, diagnostics 5/5 and custom installed focused 1/1 (19.217s); no surviving final-full log. Earlier iteration failures remain preserved, not erased or reclassified. Binding review R1 remains OPEN: local-setup still pairs cached entries with a later confirmation hash. Next executable step: capture affected journal preview and fence in one short host.lock snapshot, reuse for both replacement and retirement, and turn the reviewer's real-wizard sibling repro into a safety regression. Then focused binding tests, strict, and one default concurrent installed-enabled full gate. Prior Codex/Claude/NORMAL/CLI scoped reviews remain CLOSED. Historical broker/tool report COMPLETE, causes UNCLASSIFIED. No vendor authentication inferred.

Recovery fcd99859 — R1 fixed candidate before final gate

R1 implementation FIXED, focused VERIFIED: shared replacement/retirement preview now captures entries + journal state and hashes those exact objects under a short host.lock; no lock spans human input. Commit validates the same snapshot under its existing mutation lock. Four actual-wizard regressions adapt the reviewer's first-prompt sibling repro for both actions, showing the added affected sibling, accepting unchanged confirmation, and rejecting post-preview additions inertly. Old definition fingerprints and both existing journals remain byte-identical; existing stopped/Move/retirement guards unchanged. Strict passes; binding focused 11/11, 13.020s, no skip/failure. This closes the implementation finding, not an independent re-review claim.

Recovered custom work retained, including private direct structured argv transport, Goose-native initialize/exact fresh model/native-profile acknowledgement checks, actual custom fixture installed journey and ten diagnostic-only presets. Reviewed source notes against pinned upstream preset definitions and consumers; no arbitrary ACP/Codex-native fallback, vendor readiness claim, login or install execution. Next: ONE final strict + FULL DEFAULT concurrent installed-enabled suite on this candidate; source/binary identities and raw outcome in RECOVERY_FCD9. Prior focused custom 1/1 and diagnostics 5/5 are surviving evidence, not repeated-to-green tests.

Recovery fcd99859 — final gate outcome (executable candidate dd97d91405)

Strict PASS. ONE FULL DEFAULT concurrent installed-enabled suite finished naturally 105/106 in 161.721s, zero skip/cancel. All seven installed normal journeys (including custom, 20.009s) and all four R1 preview regressions PASS. R1 status: FIXED and production-wizard VERIFIED; no independent re-review claimed. Full gate remains OPEN: admission-cancel.test.ts:134 wrong-authority control elapsed 2572ms versus unchanged <2500ms assertion. Prior authority/Start/Stop/journal assertions passed; remaining control loop cases were not reached in that test. Raw receipts, event order and storage timestamps retained; underlying cause UNCLASSIFIED, no rerun, serial masking, inflated deadline, weakened assertion or speculative runtime fix. Evidence: WORK_LOGS/BEEHIVE_DESIGN_183FFAF0/RECOVERY_FCD9 (full-default.log, strict-final.log, binding-focused.log, source/binary hashes, RESULT.md). Final publication adds documentation only after this tested executable candidate.

Delivered ten source-grounded preset diagnostics and local custom registration; only explicit Goose-native custom contract has fixture conversation acceptance. Real installed buzz-acp/Buzz CLI signed same-agent two-channel/later replies, fresh-session model/profile Restart, history/Y preservation and privacy/injection/ missing-key/neutral Stop checks passed; vendor adapters are TypeScript fixtures. No claim ten vendors operational. Remaining provider contracts, mesh/compute, real authentication/inference/live acceptance and full-product parity remain open. Codex/Claude/NORMAL/CLI scoped reviews CLOSED; historical broker/tool report COMPLETE, causes UNCLASSIFIED, not classified by this suite or actively assigned. Next bounded gate work: instrument actual admission control replay/receipt latency at existing owners using this preserved raw failure; do not rerun-to-green or attribute storage/event-loop delays without distinguishing observations.

Admission latency reconciliation 0bea — bounded unresolved result

Verified dd97d91405 executable == f8556d157c executable (latter docs-only). Read original raw failure first: 2572ms is aggregate replay + legitimate Start + wrong-agent rejection + subsequent valid Stop/owned exit + receipt observation, not rejection latency alone. Unknown-agent rejection routes outside the slot queue and precedes Start receipt in durable order. Original 682ms rename-to-directory hook gap is before directory fsync, not its duration; missing owner/batch/completion stamps prevent original causal attribution.

One isolated env-gated instrumented immutable dd97d91405 export, strict PASS, FULL DEFAULT concurrent installed capture 106/106, natural 160.932s, no skips/cancellations. Wrong-authority 1744ms, later four controls pass. Captured unknown-agent route-to-rejection-seal 0.022ms, shared fixture event-loop blocking (max tick lateness 303.671ms), synchronous journal spans and valid owned Stop 530.798ms (500ms supervisor containment policy). Those observations classify this non-failing execution, not the original failure. No production/test semantics, authority fences, durability, reconnect policy, assertions or deadlines changed. No subsequent focused/full rerun, retry-until-failure, serial mask or signals. Actual launch chain and export-scoped children absent after natural completion.

Original 105/106 gate remains OPEN; cause UNRESOLVED, no historical closure. No speculative governing fix is warranted. Next discriminator is event-associated owner timing at failure, separating signed rejection/relay durability/client observation from legitimate Start and owned Stop, not another blind full suite. No new owner input is implied. Full report: ADMISSION_LATENCY_0BEA.md. Evidence, raw traces, source/binary pins, complete instrumentation patch/hash and cleanup: workspace WORK_LOGS/BEEHIVE_DESIGN_183FFAF0/ADMISSION_0BEA. Publication is docs-only; unchanged installed hashes separately verified, Logan Johnson + DCO. No repo CI, provider/production/native/Rust/client changes or full-product acceptance claim.

Provider 16b4 — CODE checkpoint before journeys

Implemented local Buzz Agent API-key bindings for Anthropic, OpenAI-compatible, and OpenRouter via normal setup option 8 and local-setup add-buzz-provider. Shared provider-specific input and validation, immutable binding storage, approved models, closed launch env and existing Buzz Agent exact-session/profile owner reused. No remote env/secret form or changes to authority/selection/Stop. Source pinned 051c3a2 config.rs:631–691,922–960; native Databricks auth/cache consumers also read. No vendor invocation/login/cache reads. Strict passes after correcting a TS env return-type inference error (first strict failed; no runtime test run yet). New installed journeys are prepared but not yet executed. Databricks token and richer native OAuth diagnostics remain unfinished; existing v2 path unchanged. Full gate OPEN, original admission cause UNRESOLVED; no diagnostic full rerun authorized. Instrumentation-complete.patch retained at ADMISSION_0BEA, SHA256 37de1d9fd5110017a8be3caf739a5b3a4cf56ee5e512b77ea1d7619580f84129; will adapt before any final full-candidate validation. Custom confirmation review COMPLETE SOURCE-ONLY/no new blocker; R1 source-closed plus actual wizard tests. Custom conversion remains source-only; historical report complete/unclassified.

Provider 16b4 — final candidate gate preparation

Initial NORMAL installed journeys PASS 3/3 (58.527s) for distinct Anthropic, OpenAI-compatible Responses, OpenRouter Chat env contracts. Each proves four signed same-agent replies/two channels/later turn/fresh-session Restart/exact profile and model, missing provider key, wrong-model/native/auth rejection, neutral Stop, unchanged sibling/history/manifest. Added wrong-file-credential and public endpoint privacy controls for final gate. Production prepareAgent unit controls PASS 3/3: all three OpenAI wire modes, other-provider wire rejection, HTTPS/credential/query endpoint guards, wrong model, mixed binding, unsafe/empty/symlink/missing key file. No real provider network calls; installed binaries are buzz-acp and Buzz CLI only. API-key provider diagnostic conversion/local add is implemented but not yet an executed installed journey. Databricks token and richer native OAuth diagnostics remain unfinished, existing legacy v2 path unchanged; no parity claim.

Raw PROVIDER_16B4 evidence retains first journey failures (fixed fixture session ID) and two later-turn fixture failures (session selection restored at set_model then also prompt; no protocol-owner runtime fix), plus successful journeys. First strict failed due return type inference; instrumentation adaptation had two failed patch applications and missing-module strict failures, corrected without tests running. No test assertion/deadline relaxed. Source-level self-review covered immutable bindings, private env/profiles, closed endpoint/wire contracts and Stop neutrality.

Preserved ADMISSION_0BEA patch is now narrowly adapted at the existing owners; trace inactive by default and activated ONLY by admission control tests when BEEHIVE_LATENCY_TRACE is set. Bounded 50k in-memory stamps per control, public event IDs/signatures and operation types, monotonic/wall clocks, actual async I/O completion, loop ticks; no payload/credential/result/URL capture. Exclusive 0600 capture now file+directory fsynced at test completion/failure; t.after also flushes if cleanup fails. No authority, queue, durability or timing-assertion semantic changes. Strict passes. ONE final FULL DEFAULT concurrent installed-enabled suite is next, with trace mode/source/installed hashes in PROVIDER_16B4. Original 105/106 gate remains OPEN and original cause UNRESOLVED; no diagnostic full rerun or speculative fix.

Provider 16b4 — final full outcome, gate OPEN

Executable 36e2eaca0: strict PASS; exactly ONE FULL DEFAULT concurrent installed- enabled run 111/112, zero skips/cancellations, natural 223.753s. All ten normal installed journeys PASS, including three new provider contracts and wrong private credential controls. Admission recurrence: conflicting-id aggregate 2612ms vs unchanged <2500ms, after wrong-authority passed at 1712ms. No rerun or policy fix. Durable 472-stamp failure trace (zero dropped) identifies 582.982ms synchronous journal region during legitimate Start, only 38.171ms of which are measured fsync calls; async relay await overlaps this blocking and is not disk-duration proof. Valid owned Stop contributes 531.869ms. Exact event decomposition, source/binary hashes and all failures retained in PROVIDER_16B4_RESULT.md and workspace evidence. Underlying scheduling/I/O cause remains unresolved; original 105/106 also remains UNRESOLVED independently. Next step: consume captured failure at actual owners, not retry-to-green. Three API-key providers delivered, Databricks token/richer OAuth and executed new local-add/conversion journeys remain incomplete. Mesh/compute, live admission and real vendor inference separate. This follow-up is docs-only.

Databricks bfce — executable checkpoint before final gate

Shared normal option 8 and immutable local add-buzz-provider now accept Databricks v2 static owner-only token file or explicit external native OAuth. Pinned 051c3a2 config.rs:675–680 maps DATABRICKS_TOKEN/DATABRICKS_HOST with BUZZ_AGENT_PROVIDER=databricks_v2 and BUZZ_AGENT_MODEL override. External OAuth sets no token, inspects no cache, and prints exact service HOME/config-dir native auth databricks_v2 instructions (lib.rs:151–200/auth.rs:1287–1392). Local configuration, credential presence and genuinely verified readiness remain distinct. Serialized historical mode name buzz-agent-api-key is retained for compatibility; it now contains explicit provider-specific auth, not a universal auth registry. Legacy option 2 remains compatible; new explicit auth selection uses option 8.

Focused installed helper passes 3/3: token normal, external-OAuth-config fixture normal, and diagnostic Anthropic initial -> local-add OpenRouter B -> public selection -> stopped diagnostic-to-normal immutable conversion/replacement -> public selection/Start/Restart. Each verifies real installed buzz-acp/Buzz CLI four signed same-key replies across channels/later turn, exact fresh model/profile, unchanged history/sibling, failed prerequisites preserving actual and neutral Stop. OAuth success is TS fixture behavior only, with denied and missing-refresh fixture controls: NOT a native login/refresh/provider-access claim. Custom conversion and Databricks local-add/conversion remain source-only. Strict + provider units 5/5.

Before final default full gate, fixture-activated existing trace gains post-operation JSON/UTF8/write/open/close/rename/mkdir spans and process CPU; existing fsync trace preserved. Trace row emission measured separately. CPU/wall gaps cannot establish kernel service or fully measure all instrumentation/descheduling overhead. No payloads, async durability redesign, policy/deadline/assertion changes or blind run. Evidence: WORK_LOGS/BEEHIVE_DESIGN_183FFAF0/DATABRICKS_BFCE. Final full not yet run.

Databricks bfce — final full outcome

Executable 2ea103d74: strict PASS, ONE FULL DEFAULT concurrent installed-enabled run 116/117, zero skips/cancels, natural289.084s. Three new installed journeys all PASS: Databricks token, external-OAuth-local-config fixture, Anthropic diagnostic → local-add OpenRouter → public selection → normal conversion/replacement → Start/Restart. Full gate OPEN: conflicting-id aggregate2646ms vs unchanged<2500. 598-row failure trace/zero dropped preserved; relay async rename await766.413ms before Start batch durability differs from prior journal-dominant observation. No kernel/scheduling root cause proven, historical2572/2612 remain unresolved. No rerun or speculative fix. DATABRICKS_BFCE_RESULT.md records exact contracts, source-only variants, installed/source hashes, raw evidence and limits. This final record is documentation-only after tested executable; no real OAuth/provider calls.

MODEL_PROVIDER_CORRECTION recovery candidate

R1 generic same-session drift guards now cover current-model and model-category config updates, including completion tails. Restart and Move seal prerequisite health after owned probe teardown, before destroying the old actual/source. Native Buzz requests protocol 2 and sends bare session/new.systemPrompt, following pinned source 051c3a270b (not generic ACP-v2 capability). Fixture native input evidence no longer comes from the environment marker.

The new installed Restart test initially froze an already superseded revision: instrumented old Goose case captured inventory 2 after Save receipt 3, while the new TUI displayed 3 and could never satisfy equality with 2. The test now awaits exact public Save inventory before freezing the TUI fence; no production client, deadline, retry, or equality relaxation. Same Goose case passes. Cases within normal-conversation.test.ts run sequentially, files use default Node concurrency. Evidence: workspace WORK_LOGS/BEEHIVE_DESIGN_183FFAF0/MODEL_PROVIDER_CORRECTION/ observation-old-instrumented.log, observation-fix-goose.log, final-protocol2-drift.log, strict-delivery.log. Original failures preserved. Full final gate pending here. Installed Buzz transport/CLI plus TypeScript provider fixture only: no real vendor, OAuth login/refresh, inference, or production current-kind40002 claim.

Final default installed-enabled run at 8426b2ba16: 121/122, natural 314.383s, zero skipped/cancelled. All 13 normal wizard journeys and both installed Move cases passed. Sole failure: installed-conversation's old Buzz assertion required profile text duplicated in each turn prompt, contradicting the corrected native session/new input boundary. That assertion now checks exact native-session-inputs.jsonl systemPrompt values (nonempty evidence), retaining the signed-reply and lifecycle assertions. Direct strict and focused installed-conversation 2/2 passed after this test-only correction. No second full run: final full gate is not green, and the post-full test correction has focused validation only. Original full log is retained as MODEL_PROVIDER_CORRECTION/full-default-final.log; post-full logs strict-post-full.log and installed-conversation-corrected.log. Historical admission timing failures remain unresolved, not reclassified by this run.