feat: guard unregistered Stakpak TUI pending native lifecycle fixes

[nikhilachale]

Code changes: +175 -0
Tests: +172 -0
Others: +688 -0

Binary assets in this source snapshot: 4 (excluded from line counts).

Draft qualification boundary; unregistered and launch/hooks/restore guarded.

Current status

Current source snapshot: ae5d4052b54ae0d316d49e3585f9c7f0cd97ac92 (base a7860405e4d48333204b6627ec3e83b20a99cc00). Draft; GitHub mergeability MERGEABLE, merge state BLOCKED. Exact-head CI: all 20/20 reported checks successful. CI run 1 · CI run 2 · CI run 3. Green source CI does not establish current native/UI runtime proof or full integration readiness.

This fix created only clean isolated source worktrees and temporary review reports; it created no AO/native sessions, provider profiles or owned runtime processes. No local build, gofmt, test, fixture, provider or UI run was performed.

Historical runtime build: No registered AO runtime build is qualified. Historical stock Stakpak0.3.88 failed foreground cancellation and accumulated standing system messages on restore. Supplementary native/prerelease standalone-terminal capture used AO/UI fb60bd4097ebd4109bbe7ee68e908f722e6ee03f, upstream source 62bd8833600b0f906ff841930433264ece36dbab, executable SHA256 882e7dce06ce64afe76249befff732a5f17b86c5594291526b5302a323965ac2 (reports0.3.88; unreleased patched source). Report · evidence index, original receipts, image/provenance hashes. Receipt SHAs/bytes are unchanged. Linux/VPS proof is not Windows/macOS native proof. Runner SHA256 8887aa2e7101b9e6d3950bfca08ffddf2e1e6c1c3f1d030c8dec2676443aecea remains historical where reported; manual/standalone proof is not a strict runner PASS.

Changes since runtime proof: Source remains an intentionally guarded draft/unregistered qualification boundary. Evidence relocation did not admit stock Stakpak or rerun native conformance.

The matrix separates current verification from recorded historical passes; NOT_RUN does not erase those passes. Excluded interfaces/manual model input are deliberate supported-scope decisions.

Area	Supported scope	Verification	Proof or reason
Registration and UI	Draft qualification boundary; unregistered and launch/hooks/restore guarded.	BLOCKED	Intentional unregistered qualification hold; registration is not missing work.
Models	No product model picker advertised; native model controls only.	N/A	No product capability advertised while unregistered.
Setup	Native manual prerequisites in qualification guide; no product setup plan advertised.	N/A	Qualification-only scope has no product setup plan.
Readiness	Admission is deliberately refused until released native prerequisites pass.	BLOCKED	Released-native prerequisites block admission.
Identity and logo	No product avatar/label advertised while unregistered.	N/A	No production avatar advertised.
TUI and Chat	No registered TUI or Chat; standalone terminal captures do not prove manager integration.	BLOCKED	Standalone native/prerelease captures are not registered AO proof.
Permissions and instructions	Native private/project consumption observed; renewed instructions/history duplication remains unresolved.	BLOCKED	Stock failure and prerelease controls remain distinct.
Lifecycle	Retained stock cancellation failure; patched standalone Escape control is separate from AO Kill/restore.	BLOCKED	Registered AO controls NOT_RUN; retained stock failures unresolved.
Evidence	Pinned historical source/native/runner/UI receipts, attempts, images and provenance; missing originals disclosed.	NOT_RUN	Historical evidence retained; current native/UI proof NOT_RUN. Reproduction-input limitations below remain explicit.
CI and handoff	Exact source checks/merge snapshot; incomplete live qualification and historical cleanup.	BLOCKED	Exact-head CI all 20/20 reported checks successful; mergeability MERGEABLE. Released-native admission remains blocked; draft/unregistered.

Historical implementation and evidence

Released0.3.88 Escape settled the native TUI while the witnessed shell/sleep descendant survived and wrote its delayed side effect. Exact native history continuation also accumulated two standing system messages. Private/project instructions, cwd edits and manual approvals were independent passing controls. Positional argv did not submit the task: after-start input was required. Fresh-only, background-task and tool/MCP alternatives do not cure the foreground ownership defect. The guarded adapter refuses launch/hooks/restore; no production registry/domain/API/migration/UI/reviewer changes are advertised. Historical AO source bb6b356 and recovery42a94816f54a074b56df23c8754cd35277e66125 each had 20/20 green source checks; earlier lint failure is retained.

historical receipt 1 · historical receipt 2

Reproduction and retained-original limitations

The pinned reports/JSON retain action/result, file/token effects, process identity, cancellation, native-history continuity and capture assertions. A complete sanitized executable reproduction bundle is not established for every manual helper: exact helper bytes/hash and invocation, applicable local-contract bytes/hash with probe argv and interrupt/readiness/draft-cleanup settings, and complete native/AO fingerprints are unavailable where not recorded in the linked receipts; recoverability of those original inputs is unknown. No missing command, contract, hash or result is invented. Later reproductions must use a new attempt and cannot replace original failed/missing evidence.

Recorded owned-process/session/daemon/Electron cleanup is historical. Source worktrees, native profiles/history, dirty scratch workspaces, binaries and raw logs were reported retained privately; a complete current inventory/location/hash and recoverability of every original class are unavailable in the public record. Current recoverability is unknown; this reporting fix reconstructs no missing input and silently substitutes none. Share sanitized artifacts only; exclude credential stores, raw DBs and provider-profile directories. Preserve the retained failures and original screenshots.

[github-actions]

🏆 Review leaderboard

Oct 4–11, 2026 · UTC

Rank	Reviewer	PRs reviewed	Review rounds	PR comments
🥇	@illegalcall	31	51	8
🥈	@ronishrohan	16	19	11
🥉	@Prasad-D-Ware	12	21	0
4	@nikhilachale	11	24	3
5	@Vaibhaav-Tiwari	8	11	3
6	@axisrow	8	10	10
7	@mohakchakraborty2004	7	7	1
8	@codebanditssss	6	10	2
9	@Pritom14	5	5	4
10	@Rishet11	4	10	2

Ranked by distinct external PRs reviewed, then review rounds, then PR comments. Self-activity and bot activity are excluded.

Show 5 more reviewers

Rank	Reviewer	PRs reviewed	Review rounds	PR comments
11	@Annieeeee11	3	6	1
12	@neversettle17-101	3	4	0
13	@harshitsinghbhandari	2	4	0
14	@whoisasx	2	2	0
15	@AgentWrapper	1	3	0

[nikhilachale]

Stakpak native qualification is BLOCKED, not an AO integration pass. Immutable curated report and receipts at PR6509 evidence head fdb27762a88580ad070b82ba8a5b073d8a6ff30d; both report and JSON downloaded and SHA-256 verified. Source head 3c2f9d688858491c7db7a70bef15ab43f06886b9 remains guarded and unregistered.

Official v0.3.88 / Z.ai glm-5.3-flash native proof established correct-workspace edits, additive private instructions, preserved AGENTS.md, native manual approvals, real-history restore and fresh token consumption. The exact submitted initial task occurred once in durable history; positional argv alone did not submit it.

FAIL cancellation: manually approved shell PID932367/kernel-start78005410 and sleep survived Escape, reparented to PID1092, and wrote the delayed side effect. FAIL instruction deduplication: native restored checkpoint had2 system messages/2 original standing-token occurrences. Native foreground cancellation calls immediate child.kill; documented background cancel_task does not qualify this boundary. Non-restorable scope does not solve the shell leak. No monkeypatch/security disablement.

AO sessions/screenshots/Kill/control/activity admission: NOT_RUN / unavailable because production admission was withheld. No fabricated native ID/ACP/reviewer/handoff. All owned native/child PIDs were absent after the witnessed deadline and exact tmux teardown; profiles/history and production PID625660/service preserved. Routine verification is current-head GitHub CI only; no local suites run. Leave draft pending a released native fix and actual AO proof. Skill reference synced to the installed VPS skill.

[nikhilachale]

Final stage receipt: source bb6b356d6d214977becdc341949aba86b19ddc29 has20/20 green current-head GitHub Actions checks; PR6509 evidence fdb27762a88580ad070b82ba8a5b073d8a6ff30d has5/5 green current-head checks. The original lint failure was inspected remotely and fixed; no routine local suites ran. Verified net source counts: Code+175/-0, Tests+172/-0, Others+87/-0, no binary assets.

Status remains BLOCKED / draft / unregistered. Released Stakpak0.3.88 Escape left a witnessed shell/sleep alive and its delayed artifact appeared. Exact native restore consumed new private instructions but accumulated2 persisted system messages. Supported background cancel_task and non-restorable scope do not resolve foreground cancellation. Immutable native evidence, report/JSON download/hash verified.

Actual AO UI screenshot and AO activity/admission/Kill/control gates remain NOT_RUN/unavailable because native admission failed. This is not an integrated harness claim. Owned native/child PIDs were confirmed absent; native profiles/history, prior evidence, dirty/preparation worktrees and production service/PID625660 preserved. Installed skill docs synced; runner unchanged. Supervisor may proceed to the next candidate. Requalification requires a released native fix, then actual AO/Electron proof; do not merge or deploy.

[nikhilachale]

Recovery source analysis and exact native patch/regression proposal: https://github.com/nikhilachale/agent-orchestrator/blob/ae5d4052b54ae0d316d49e3585f9c7f0cd97ac92/docs/research/stakpak-recovery-proposal-2026-10-12.md

The official latest release is still0.3.88. Its foreground executor creates a separate group but kills only the immediate child; the CLI returns cancelled before cleanup acknowledgement. Upstream main has no repair. Supported tool advertising is not enforced exclusion, reserved native MCP replacement is prohibited, ACP shares the executor, and fresh-only scope does not fix ownership. The proposal covers owned job lifecycle, both cancel branches, timeout/drop/disconnect, PID reuse, explicit cleanup acknowledgement and same-session regression controls; instruction renewal/ACP restore are separate proposals.

Prior witnessed survivor/late-side-effect failure is preserved. No unchanged Escape rerun, vendor monkeypatch, native permission weakening or fabricated AO proof. Stakpak remains unregistered and PR6550 remains draft. Actual AO screenshots and independent Kill are unavailable for this guarded candidate; Kill cannot substitute for same-session cancellation. Installed skill lessons updated; published report downloaded and SHA256 verified: e19fe26fe9763ca308563334db6d37cacf685cb75ad891db3aa9119300c6ed63. Current-head remote CI is pending; prior green checks are historical. No local suites, new native/provider process, native profile/credential edit or production activity.

[nikhilachale]

Recovery exact-head CI: PR6550 42a94816f54a074b56df23c8754cd35277e66125 is20/20 green. PR6509 6f109056b4352310d47196fda6b4c9a5a727468a is4/5 green; its frontend test job is still running, with no failure reported. Source remains draft/unregistered because stock-native cancellation is externally blocked; green AO CI does not establish native conformance. No local routine suites ran.

Recovery result and exact remaining upstream prerequisite are recorded privately at harness-recovery-20261012/reports/stakpak/result.json; published source patch/regression proposal: https://github.com/nikhilachale/agent-orchestrator/blob/ae5d4052b54ae0d316d49e3585f9c7f0cd97ac92/docs/research/stakpak-recovery-proposal-2026-10-12.md . No AO screenshot available for the guarded/unregistered candidate. Stock binary hash unchanged, prior owned PIDs absent, no new process to clean. No merge/release/deploy/upstream post.

[nikhilachale]

Failure report and fix implementation started (2026-10-12).

Stock Stakpak v0.3.88 remains unqualified: after a witnessed foreground shell started, native Escape left descendants alive and a delayed side-effect file appeared. The pinned executor creates a process group but the cancellation/timeout paths kill only the immediate child. Cancellation forwarding/future-drop ownership also needs correction. The existing source trace and reproducer preserves the failure.

The earlier document was a proposal, not an implemented fix. A durable VPS implementation worker is now applying the native source correction in an isolated upstream checkout, with focused executor/transport regression tests and a real fix PR. Relevant tests and native build will run in GitHub CI only; exact-head artifacts will be used for native and AO qualification.

This AO PR stays draft until its required proof is obtained. No stock-native success or AO screenshot is claimed yet. Fresh-only scope will continue to reject restore; the distinct history/duplicate-instructions defect is not silently waived. Actual fix PR, CI results and labelled prerelease AO screenshots will be linked here as available. No Mac source changes/tests/builds; no merge or release.

[nikhilachale]

Concrete native source fix is now open for review: stakpak/agent#767 (draft; nikhilachale:fix/foreground-command-cancellation, current head f075b5f1f8a2dc35b48967f1ad94b837ae631a9d).

The patch owns the foreground command child, signals its Unix process group while its leader is unreaped on cancel/timeout/drop, bounds explicit cleanup, and preserves successful-command behavior. Real MCP/executor CI regressions cover both cancellation branches, timeout, coordinated disconnect, execution-future abort, nested shell/sleep identities, unrelated control and subsequent requests. CI also requires the stock executor to fail the cancellation regression.

Validation and exact CI-artifact Escape/AO qualification are still pending. Stock0.3.88 remains FAIL; PR6550 stays unregistered/draft. No restore/history fix or Windows tree guarantee is claimed. All routine validation runs in GitHub Actions; no local suites or native compilation were run on the VPS.

[nikhilachale]

Concrete Stakpak native foreground fix is implemented in stakpak/agent767, source 62bd8833600b0f906ff841930433264ece36dbab. Exact CI-built Linux artifact SHA 882e7dce06ce64afe76249befff732a5f17b86c5594291526b5302a323965ac2; it reports0.3.88 but is explicitly unreleased patched source, not repaired stock release.

Current qualification job: 9/9 PASS, compiled stock negative control, affected lint and release build. Full upstream workspace/feature suite: CANCELLED/NOT_VERIFIED after repeated hosted stalls/timeouts and unavailable logs; native PR stays draft. No routine local suites/builds/native compilation ran.

Exact artifact passed22 native checks in the actual AO Electron standalone terminal: initial leading-dash task once in history, real cwd, private/project instructions, AGENTS preservation, initial/second/third active→settled turns, observed foreground shell/sleep PID/start witnesses, Escape with immediate physical PID absence, no25-second delayed artifact, unrelated PID/start/heartbeat control, same native identity and third turn after cancellation. Tool timeout35s exceeded the cancellation time. This is supplementary native/runtime evidence; AO6550 remains unregistered/draft, with no manager/agent-session Kill, restore, Chat, handoff, catalog or registered-auth claims.

Immutable detailed report and receipt. All four PNG URLs were downloaded and SHA-256 verified after publication; images inspected for credentials. Backend/UI source fb60bd4097ebd4109bbe7ee68e908f722e6ee03f; serving PID979004/hash b30f2dfa7b1f1c796c5772cb96d7d5c32b4bfb53c39f2c4ff7ca669f2cca8ded before/after. Native identity digest 8082f814ca93f1963292a78cc9d01f18f4ed3fc1fce8ec7b7f8fe7d8fa20d198; runtime handle ptyhost-v1:shellterm-8968a375bddfe0aa, host985380/start82945904. Standalone shells have no managed agent generation. Model rendered GLM-5.3-Flash/provider Zai/profile audit. Capture: real Electron/scrot on owned Xvfb display.

UTC2026-10-12T05:56:59Z, native command executing; PNG SHA 01432b5596ea1d7c7700d454386279154d0d13fcf82a029668c18fee54497786:

UTC2026-10-12T06:03:07Z, same native identity after Escape and third count3 turn; PNG SHA 526ccf4f6a99cf97bbf45b362b2080fda640c93123083b21005cbf760e54da10:

Retained failure: earlier16e63ed startup after forced renderer reload inserted OSC11 reply text before the prompt (FAIL, UTC05:17:23Z); actual failed screen. Clean fresh launch is a separate passing control; reconnect behavior remains unqualified. Default security/permissions were preserved. Original stock Escape failure and restore-system duplication remain failures; original AO screenshot unavailable because no registered session existed then.

Cleanup: both final shell closes204; shell list200/empty; runtime hosts/native/control PIDs absent; owned Electron main978778 and launch members stopped; scratch daemon979004 shutdown202 and absent; mux helpers stopped and compute lock released. Production625660/ao-self-hosted, profiles/credentials/source/shared git/prior evidence untouched. Runner SHA8887aa2e... unchanged. No merge, release publish, deployment, signup or billing change.

[nikhilachale]

Harness-specific reports, JSON receipts, screenshots and provenance now live on this integration PR branch, rather than the skill PR #6509.

Evidence index with embedded screenshots and JSON links.

These screenshots show native/prerelease controls in AO standalone terminals. The harness remains gated/unregistered; this is NOT registered AO integration or manager Kill/restore proof.

This is evidence relocation only. Existing tested source/native hashes and failures are preserved; the documentation commit is not a fresh runtime pass. Applicable checks run in PR CI.