Bundle: Software Garden fleet/PTY/subscription fixes (#1913, #1910, #1900, #1893)

.agentworkforce/trajectories/active/traj_ynyux9pee7x7/trajectory.json

@@ -31,6 +31,108 @@
             "reasoning": "npm ci pinned SDK 8.0.7 without metadata while Publish Package freshly resolves 8.14.0 with relay.action-caller=v1. Align CI with release resolution without weakening assertions or changing production code."
           },
           "significance": "high"
+        },
+        {
+          "ts": 1791096850177,
+          "type": "decision",
+          "content": "Root-caused tail truncation to paced per-codepoint typing (5ms/atom) with no bracketed-paste framing for Claude; plan fixes it with capability-gated atomic paste + head/tail-anchored confirmation: Root-caused tail truncation to paced per-codepoint typing (5ms/atom) with no bracketed-paste framing for Claude; plan fixes it with capability-gated atomic paste + head/tail-anchored confirmation",
+          "raw": {
+            "question": "Root-caused tail truncation to paced per-codepoint typing (5ms/atom) with no bracketed-paste framing for Claude; plan fixes it with capability-gated atomic paste + head/tail-anchored confirmation",
+            "chosen": "Root-caused tail truncation to paced per-codepoint typing (5ms/atom) with no bracketed-paste framing for Claude; plan fixes it with capability-gated atomic paste + head/tail-anchored confirmation",
+            "alternatives": [],
+            "reasoning": "write_paced emits one VT atom per write_all, so a 6.7KB task spends ~33s only in the TUI composer; any composer clear in that window loses the head. devin.rs:12 wraps paste only for Devin. check_echo_in_output cannot detect the loss, so pty_worker.rs:2368 acks it as timeout_fallback success."
+          },
+          "significance": "high"
+        },
+        {
+          "ts": 1791099654001,
+          "type": "decision",
+          "content": "Reserve per-byte VTE parsing for chunks carrying the DECSET 2004 parameter: Reserve per-byte VTE parsing for chunks carrying the DECSET 2004 parameter",
+          "raw": {
+            "question": "Reserve per-byte VTE parsing for chunks carrying the DECSET 2004 parameter",
+            "chosen": "Reserve per-byte VTE parsing for chunks carrying the DECSET 2004 parameter",
+            "alternatives": [],
+            "reasoning": "The paste-capability latch parsed every PTY output byte with its own processor.advance() call until the mode was seen, which is permanent for any harness that never enables 2004. Scanning the chunk for the literal 2004 and otherwise bulk-parsing with one post-chunk mode check keeps enable+disable-in-one-read detection (both complete sequences must contain 2004) and still latches a sequence split across reads."
+          },
+          "significance": "high"
+        },
+        {
+          "ts": 1791099654447,
+          "type": "decision",
+          "content": "Treat the two failing CLI suites and four Rust hook-chain tests as sandbox environment, not branch regressions: Treat the two failing CLI suites and four Rust hook-chain tests as sandbox environment, not branch regressions",
+          "raw": {
+            "question": "Treat the two failing CLI suites and four Rust hook-chain tests as sandbox environment, not branch regressions",
+            "chosen": "Treat the two failing CLI suites and four Rust hook-chain tests as sandbox environment, not branch regressions",
+            "alternatives": [],
+            "reasoning": "sdk-client.test.ts and fleet-lifecycle-integration.test.ts assert no ambient gateway is inherited and read the real process env; this sandbox exports RELAY_BASE_URL, which no CI workflow sets. The spawner hook-chain tests are defeated by the sandbox's GIT_CONFIG_COUNT core.hooksPath=/dev/null override. Both fixed in .relayflow/check.sh (uncommitted) rather than by changing tests."
+          },
+          "significance": "high"
+        },
+        {
+          "ts": 1791100397805,
+          "type": "decision",
+          "content": "Review current PR and staged repair together; withhold clean signoff for unverified task success: Review current PR and staged repair together; withhold clean signoff for unverified task success",
+          "raw": {
+            "question": "Review current PR and staged repair together; withhold clean signoff for unverified task success",
+            "chosen": "Review current PR and staged repair together; withhold clean signoff for unverified task success",
+            "alternatives": [],
+            "reasoning": "The user requires full receipt confirmation; timeout_fallback still completes a verified spawn successfully."
+          },
+          "significance": "high"
+        },
+        {
+          "ts": 1791100495394,
+          "type": "decision",
+          "content": "Review PR 1893 requests changes: timeout success and incomplete-echo confirmations remain: Review PR 1893 requests changes: timeout success and incomplete-echo confirmations remain",
+          "raw": {
+            "question": "Review PR 1893 requests changes: timeout success and incomplete-echo confirmations remain",
+            "chosen": "Review PR 1893 requests changes: timeout success and incomplete-echo confirmations remain",
+            "alternatives": [],
+            "reasoning": "188 CLI tests and six PTY tests pass; temporary adversarial PTY integration reproduces echo_anchors for a missing middle and paste_summary for a marker plus 40-byte tail. Findings recorded in review.md; no review.clean."
+          },
+          "significance": "high"
+        },
+        {
+          "ts": 1791100867791,
+          "type": "decision",
+          "content": "Positive delivery confirmation requires whole-payload echo evidence; endpoint anchors and collapsed-paste markers are inconclusive, and an unconfirmed initial task resolves a verified fleet spawn as an explicit non-retryable unconfirmed outcome rather than success: Positive delivery confirmation requires whole-payload echo evidence; endpoint anchors and collapsed-paste markers are inconclusive, and an unconfirmed initial task resolves a verified fleet spawn as an explicit non-retryable unconfirmed outcome rather than success",
+          "raw": {
+            "question": "Positive delivery confirmation requires whole-payload echo evidence; endpoint anchors and collapsed-paste markers are inconclusive, and an unconfirmed initial task resolves a verified fleet spawn as an explicit non-retryable unconfirmed outcome rather than success",
+            "chosen": "Positive delivery confirmation requires whole-payload echo evidence; endpoint anchors and collapsed-paste markers are inconclusive, and an unconfirmed initial task resolves a verified fleet spawn as an explicit non-retryable unconfirmed outcome rather than success",
+            "alternatives": [],
+            "reasoning": "review.md P1 x3: timeout_fallback/anchors/paste_summary all reached the spawn success branch, so a swallowed or middle-truncated task was indistinguishable from a received one"
+          },
+          "significance": "high"
+        },
+        {
+          "ts": 1791101890744,
+          "type": "decision",
+          "content": "Report what the terminal actually showed (echo_incomplete / paste_summary) instead of labelling every unconfirmed ack timeout_fallback: Report what the terminal actually showed (echo_incomplete / paste_summary) instead of labelling every unconfirmed ack timeout_fallback",
+          "raw": {
+            "question": "Report what the terminal actually showed (echo_incomplete / paste_summary) instead of labelling every unconfirmed ack timeout_fallback",
+            "chosen": "Report what the terminal actually showed (echo_incomplete / paste_summary) instead of labelling every unconfirmed ack timeout_fallback",
+            "alternatives": [],
+            "reasoning": "Operators need to tell a collapsed paste apart from a silent agent; the runtime gates on verification_label_confirms_receipt, so richer labels cost nothing in correctness"
+          },
+          "significance": "high"
+        },
+        {
+          "ts": 1791101891202,
+          "type": "reflection",
+          "content": "Three P1s shared one root cause: confirmed() conflated 'some evidence' with 'full receipt'. Narrowing confirmation to whole-payload echo and gating the spawn result on the label fixed all three; 20 cold starts and the two adversarial fixture modes pass.",
+          "raw": {
+            "focalPoints": [
+              "verification-policy",
+              "spawn-confirmation"
+            ],
+            "confidence": 0.85
+          },
+          "significance": "high",
+          "tags": [
+            "focal:verification-policy",
+            "focal:spawn-confirmation",
+            "confidence:0.85"
+          ]
         }
       ]
     }

.agentworkforce/trajectories/devin-trust-fix/compacted/compact_d6sq3rpl6inr_2026-10-06.json

@@ -0,0 +1,48 @@
+{
+  "id": "compact_hbapxe3axu5d",
+  "version": 1,
+  "type": "compacted",
+  "compactedAt": "2026-10-06T13:43:02.276Z",
+  "sourceTrajectories": [
+    "traj_t5rhaj5534rg"
+  ],
+  "dateRange": {
+    "start": "2026-10-06T13:38:30.682Z",
+    "end": "2026-10-06T13:42:41.615Z"
+  },
+  "summary": {
+    "totalDecisions": 2,
+    "totalEvents": 2,
+    "uniqueAgents": [
+      "default"
+    ]
+  },
+  "decisionGroups": [
+    {
+      "category": "api",
+      "decisions": [
+        {
+          "question": "Implement reviewed-plan Part 1; defer automatic trust acceptance pending real captures",
+          "chosen": "Implement reviewed-plan Part 1; defer automatic trust acceptance pending real captures",
+          "reasoning": "No Devin binary or raw trust captures are available. Preserve the existing Claude planner and generic Devin approval restrictions. Add the Devin veto to both startup gate paths; deadline uses detector and verification ticks. CLI help inspection and advisory path corroboration remain Part 2 prerequisites.",
+          "fromTrajectory": "traj_t5rhaj5534rg"
+        }
+      ]
+    },
+    {
+      "category": "testing",
+      "decisions": [
+        {
+          "question": "Run broker validation without inherited Git config injection",
+          "chosen": "Run broker validation without inherited Git config injection",
+          "reasoning": "The default suite passed 1374 tests and failed four hook-chain tests because the runner injects core.hooksPath. With GIT_CONFIG_COUNT unset only in the test process, all four hook tests pass and all 1378 broker unit tests pass.",
+          "fromTrajectory": "traj_t5rhaj5534rg"
+        }
+      ]
+    }
+  ],
+  "keyLearnings": [],
+  "keyFindings": [],
+  "filesAffected": [],
+  "commits": []
+}

.agentworkforce/trajectories/devin-trust-fix/compacted/compact_d6sq3rpl6inr_2026-10-06.md

@@ -0,0 +1,21 @@
+# Trajectory Compaction: Oct 6, 2026 - Oct 6, 2026
+
+## Summary
+- Sessions: 1
+- Decisions: 2
+- Events: 2
+- Agents: default
+- Files: 0
+- Commits: 0
+
+## Api
+- Implement reviewed-plan Part 1; defer automatic trust acceptance pending real captures -> Implement reviewed-plan Part 1; defer automatic trust acceptance pending real captures (traj_t5rhaj5534rg)
+
+## Testing
+- Run broker validation without inherited Git config injection -> Run broker validation without inherited Git config injection (traj_t5rhaj5534rg)
+
+## Key Learnings
+- None
+
+## Key Findings
+- None

.agentworkforce/trajectories/fleet-spawn-fix/compacted/compact_o598x260wugy_2026-10-04.json

@@ -0,0 +1,89 @@
+{
+  "id": "compact_o598x260wugy",
+  "version": 1,
+  "type": "compacted",
+  "compactedAt": "2026-10-04T14:54:40.616Z",
+  "sourceTrajectories": [
+    "traj_ro3v7jmydpo5"
+  ],
+  "dateRange": {
+    "start": "2026-10-04T14:42:43.542Z",
+    "end": "2026-10-04T14:54:28.331Z"
+  },
+  "summary": {
+    "totalDecisions": 4,
+    "totalEvents": 4,
+    "uniqueAgents": [
+      "default"
+    ]
+  },
+  "decisionGroups": [
+    {
+      "category": "other",
+      "decisions": [
+        {
+          "question": "Keep SDK error unions unchanged; use CLI-owned pending and collision errors with known-class exit codes",
+          "chosen": "Keep SDK error unions unchanged; use CLI-owned pending and collision errors with known-class exit codes",
+          "reasoning": "Preserve SDK behavior and sandbox safety; uncertain accepted spawns exit 8 with diagnostics.",
+          "fromTrajectory": "traj_ro3v7jmydpo5"
+        }
+      ]
+    },
+    {
+      "category": "security",
+      "decisions": [
+        {
+          "question": "Ship removal waits opt-in; use get not-found and deadline list absence, never released status",
+          "chosen": "Ship removal waits opt-in; use get not-found and deadline list absence, never released status",
+          "reasoning": "No workspace credential environment variables or machine-global agent-relay configuration are available for live deletion verification. Reviewed-plan section 3.7 requires opt-in in this case. Exit 8 requires observed presence; all-read failures keep the asynchronous acknowledgement.",
+          "fromTrajectory": "traj_ro3v7jmydpo5"
+        }
+      ]
+    },
+    {
+      "category": "naming",
+      "decisions": [
+        {
+          "question": "Keep existing asynchronous broker identity cleanup; expose safe name-reuse guidance",
+          "chosen": "Keep existing asynchronous broker identity cleanup; expose safe name-reuse guidance",
+          "reasoning": "Cleanup is already scheduled for owned failed spawns. A collision never grants ownership of the incumbent identity. Fleet release adds removal evidence to its existing JSON only with --wait.",
+          "fromTrajectory": "traj_ro3v7jmydpo5"
+        }
+      ]
+    },
+    {
+      "category": "api",
+      "decisions": [
+        {
+          "question": "Final invocation reads preserve the actual requested readiness contract",
+          "chosen": "Final invocation reads preserve the actual requested readiness contract",
+          "reasoning": "SDK confirm:true also requests verify_ready by default. A late terminal result must have ready:true; live heartbeat recovery remains explicitly confirmed:false. Late persona child acknowledgements stay pending and retain their child invocation/node.",
+          "fromTrajectory": "traj_ro3v7jmydpo5"
+        }
+      ]
+    }
+  ],
+  "keyLearnings": [],
+  "keyFindings": [],
+  "filesAffected": [
+    ".agentworkforce/trajectories/fleet-spawn-fix/active/traj_ro3v7jmydpo5/trajectory.json",
+    "CHANGELOG.md",
+    "crates/broker/src/runtime/relaycast_events.rs",
+    "packages/cli/README.md",
+    "packages/cli/src/cli/commands/agent.test.ts",
+    "packages/cli/src/cli/commands/agent.ts",
+    "packages/cli/src/cli/commands/fleet.test.ts",
+    "packages/cli/src/cli/commands/fleet.ts",
+    "packages/cli/src/cli/lib/agent-registration.ts",
+    "packages/cli/src/cli/lib/agent-removal.test.ts",
+    "packages/cli/src/cli/lib/agent-removal.ts",
+    "packages/cli/src/cli/lib/fleet-live-agents.ts",
+    "packages/cli/src/cli/lib/sdk-command.test.ts",
+    "packages/cli/src/cli/lib/sdk-command.ts",
+    "packages/cli/src/cli/lib/spawn-liveness.test.ts",
+    "packages/cli/src/cli/lib/spawn-liveness.ts"
+  ],
+  "commits": [
+    "5c8b798"
+  ]
+}

.agentworkforce/trajectories/fleet-spawn-fix/compacted/compact_o598x260wugy_2026-10-04.md

@@ -0,0 +1,33 @@
+# Trajectory Compaction: Oct 4, 2026 - Oct 4, 2026
+
+## Summary
+- Sessions: 1
+- Decisions: 4
+- Events: 4
+- Agents: default
+- Files: 16
+- Commits: 1
+
+## Other
+- Keep SDK error unions unchanged; use CLI-owned pending and collision errors with known-class exit codes -> Keep SDK error unions unchanged; use CLI-owned pending and collision errors with known-class exit codes (traj_ro3v7jmydpo5)
+
+## Security
+- Ship removal waits opt-in; use get not-found and deadline list absence, never released status -> Ship removal waits opt-in; use get not-found and deadline list absence, never released status (traj_ro3v7jmydpo5)
+
+## Naming
+- Keep existing asynchronous broker identity cleanup; expose safe name-reuse guidance -> Keep existing asynchronous broker identity cleanup; expose safe name-reuse guidance (traj_ro3v7jmydpo5)
+
+## Api
+- Final invocation reads preserve the actual requested readiness contract -> Final invocation reads preserve the actual requested readiness contract (traj_ro3v7jmydpo5)
+
+## Key Learnings
+- None
+
+## Key Findings
+- None
+
+## Completion evidence
+
+CLI and MCP pending spawn evidence, fresh target-node heartbeat checks, sandbox preservation, opt-in name-clearance waits, readable registration collisions, and roster heartbeat ages are implemented. SDK behavior and workflow files are unchanged.
+
+Full CLI suite: 2,021 passed, 17 skipped with inherited RELAY_BASE_URL unset. Typechecking and the latest 72 MCP regression tests passed. Cargo is unavailable, so the Rust formatter regression was not run. No live workspace credentials were available; removal waits remain opt-in under reviewed-plan section 3.7.