@@ -4,3 +4,7 @@ updates:
     directory: "/mcp"
     schedule:
       interval: monthly
+  - package-ecosystem: github-actions
+    directory: "/"
+    schedule:
+      interval: monthly
@@ -15,8 +15,12 @@ concurrency:
 
 jobs:
   ci:
-    name: Windows CI
-    runs-on: windows-latest
+    name: CI (${{ matrix.os }})
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [windows-latest, ubuntu-latest, macos-latest]
+    runs-on: ${{ matrix.os }}
     defaults:
       run:
         working-directory: mcp
@@ -40,5 +44,8 @@ jobs:
       - name: Run build
         run: npm run build
 
+      - name: Check committed bundle matches source
+        run: git diff --exit-code -- dist/server.cjs
+
       - name: Run tests
         run: npm test
@@ -7,6 +7,20 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+### Fixed
+- Replace fabricated POSIX identities with Linux boot-scoped kernel start tokens and macOS process start/executable/argv probes; fail closed on query errors.
+- Parse DMTF timezone offsets as signed minutes; use shared POSIX process-group teardown for directly owned children.
+- Publish slot leases atomically, recover provably dead directory-lock owners, and report legacy locks/corrupt leases as blocked capacity.
+- Align slot defaults with the eight-worker cap; cache process probes per scan and use cheap Windows liveness checks during termination waits.
+- Require manifest hashes before patch application; preserve replacement common-directory lock owners on release.
+- Return structured job-action data and a clear no-active-worker cancellation result; derive storage health from corruption counts.
+- Bound output copying using chunk accumulation and a circular tail buffer; remove the redundant full health scan from async dispatch.
+- Use the Antigravity CLI's configured model by default; document agent/model and the currently unenforced retention policy.
+- Run CI on Windows, Linux and macOS, check committed bundle drift, and update GitHub Actions via Dependabot.
+- Preserve job evidence during retention cleanup when timestamps are missing or malformed.
+- Reject invalid cleanup clocks and negative or non-finite retention windows before scanning the ledger.
+- Add regression coverage for retention boundaries, future timestamps, creation-time fallback, and dry-run/destructive cleanup safety.
+
 ## [1.1.0] - 2026-09-10
 
 ### Added
 
@@ -34,7 +34,7 @@ The repository coordinates atomic subagent execution through an MCP server inter
 ### Focused Change Workflow
 1. **Targeted Scope**: Always scope changes to explicit, non-overlapping target files or module prefixes. Avoid large refactors or incidental formatting changes across unrelated files.
 2. **Worktree Isolation**: Never mutate shared state directly during exploratory or agent runs. The harness uses `isolation: "worktree"` for mutating delegations. Changes must be reviewed and explicitly applied.
-3. **Disjoint Concurrency**: When splitting tasks across parallel workers, ensure disjoint target paths with a maximum concurrency limit of 4 worker slots (`MAX_WORKER_SLOTS = 4`).
+3. **Disjoint Concurrency**: When splitting tasks across parallel workers, ensure disjoint target paths with a hard maximum of 8 worker slots, subject to adaptive CPU/memory admission (`MAX_WORKER_SLOTS = 8`).
 4. **Untrusted Worker Output**: In this architecture, worker execution claims are considered untrusted until parent verification executes automated checks.
 
 ---
@@ -63,8 +63,8 @@ To verify MCP protocol communication independently:
 npm run test:protocol
 ```
 
-### Root Integration Tests
-From the workspace root directory:
+### Root Test Aliases
+These convenience entry points import the same suites already included in `npm test`; they are not additional, orphaned tests. From the workspace root directory:
 ```bash
 node test/leases.test.mjs
 node test/ledger.test.mjs
 
@@ -116,10 +116,12 @@ flowchart TD
 2. **Untrusted Worker Principle**: Worker claims are untrusted by default. The parent orchestrator inspects actual git/filesystem diffs and executes automated tests before changes are accepted.
 3. **Explicit Apply & Finalize**: Completed worktree changes are never merged automatically. The parent orchestrator reviews the patch hash, applies verified changes, and cleans up the worktree.
 4. **Path Traversal Protection**: Target paths are constrained to the workspace root; directory traversal (`..`) attempts outside the workspace are rejected.
-5. **Retention Policies**:
+5. **Retention and Cleanup**:
 
-   * **Worktrees**: Retained for 24 hours (1,440 minutes by default) to allow manual inspection and debugging before disposal.
-   * **Evidence Ledger**: Job logs, terminal events, and hashes are kept for 14 days for forensic traceability.
+   * **Worktrees**: Use explicit `agy_job finalize` after verification to remove a job's worktree. The `retentionMinutes` field (default 1,440) is reserved policy metadata, **not an automatic expiry timer**.
+   * **Evidence Ledger**: Automatic ledger/outbox pruning is not currently wired into the runner or `reconcile`. The 14-day evidence constant is a policy target, not an enforced deletion schedule. Monitor disk usage and retain evidence needed for pending callbacks and review.
+   * **Fail-safe Cleanup Library**: `collectEligibleJobs` is an explicit library operation (24-hour default window). It preserves active, unfinalized, callback-pending and corrupt jobs, and jobs with missing or malformed retention timestamps (`invalid_timestamp`). It rejects invalid clocks and negative/non-finite retention windows before scanning.
+   * **Blocked Leases**: New owner-bearing slot locks recover when their owner is provably dead. Legacy nonce-only locks and corrupt leases are reported as blocked capacity and preserved. Verify no worker is still using the slot before manual repair; malformed data is not proof that a worker has stopped.
 
 ---
 
@@ -240,6 +242,9 @@ Synchronously delegates a bounded task to Antigravity and waits for the result.
 * `timeoutSeconds` (number, default `300`): Execution timeout (1–1800s). Sizing target is under 25s.
 * `outputFormat` (`"text"` | `"json"`, default `"text"`): Desired output structure.
 * `resumeJobId` (string, optional): Resume a prior job attempt in its existing worktree.
+* `agent` (string, optional): Antigravity agent identifier, forwarded as `--agent`.
+* `model` (string, optional): Antigravity model identifier, forwarded as `--model`. When omitted, the harness uses the CLI's configured default rather than pinning a model.
+* `retentionMinutes` (integer, optional, 10–10080): Reserved policy metadata; currently does not schedule deletion. Use explicit `agy_job finalize` for worktree cleanup.
 
 ```json
 {
@@ -273,7 +278,7 @@ Dispatches a background worker task and returns an immediate acknowledgement. Wh
 ```
 
 ### `agy_job`
-Inspects or manages the lifecycle of transactional jobs.
+Inspects or manages the lifecycle of transactional jobs. Successful responses include the parsed job-action result in MCP `structuredContent`, including `state` and `attempts[].artifactPaths` for status, or `jobs` for list. The JSON text response is retained for compatibility.
 
 **Parameters**:
 
 
@@ -35,7 +35,7 @@
     "check": "tsc --noEmit",
     "prepack": "npm run build && node scripts/package-assets.mjs prepare",
     "postpack": "node scripts/package-assets.mjs clean",
-    "test": "node test/system-capacity.mjs && node test/activity.mjs && node test/ledger-outbox.mjs && node test/process-leases.mjs && node test/contracts.mjs && node test/git-artifacts.mjs && node test/sparse-worktree.mjs && node test/runner-controller.mjs && node test/smoke.mjs --protocol-only && node test/deterministic.mjs",
+    "test": "node test/reliability.mjs && node test/system-capacity.mjs && node test/activity.mjs && node test/ledger-outbox.mjs && node test/process-leases.mjs && node test/contracts.mjs && node test/git-artifacts.mjs && node test/sparse-worktree.mjs && node test/runner-controller.mjs && node test/smoke.mjs --protocol-only && node test/deterministic.mjs",
     "test:protocol": "node test/smoke.mjs --protocol-only",
     "test:live": "node test/smoke.mjs"
   },
 
@@ -1,12 +1,14 @@
 #!/usr/bin/env node
 
-import { spawn, spawnSync } from 'node:child_process';
+import { spawn } from 'node:child_process';
 import { access, mkdtemp, rm, stat, writeFile } from 'node:fs/promises';
 import { constants, existsSync } from 'node:fs';
 import os from 'node:os';
 import path from 'node:path';
 import { randomUUID } from 'node:crypto';
 
+import { terminateOwnedProcessTree as terminateProcessTree } from '../../skills/delegate-to-antigravity/scripts/lib/owned-process.mjs';
+
 import { McpServer } from '@modelcontextprotocol/server';
 import { serveStdio } from '@modelcontextprotocol/server/stdio';
 import * as z from 'zod/v4';
@@ -68,43 +70,29 @@ async function runnerAvailable(): Promise<boolean> {
   }
 }
 
-function terminateProcessTree(child: ReturnType<typeof spawn>): void {
-  if (!child.pid) return;
-  if (process.platform === 'win32') {
-    spawnSync('taskkill', ['/PID', String(child.pid), '/T', '/F'], {
-      windowsHide: true,
-      stdio: 'ignore',
-    });
-  } else {
-    child.kill('SIGTERM');
-  }
-}
 
 function runProcess(command: string, args: string[], cwd: string, timeoutMs: number): Promise<RunResult> {
   return new Promise((resolve, reject) => {
     const child = spawn(command, args, {
       cwd,
       env: process.env,
       windowsHide: true,
+      detached: process.platform !== 'win32',
       stdio: ['ignore', 'pipe', 'pipe'],
     });
-    let stdout: Buffer<ArrayBufferLike> = Buffer.alloc(0);
-    let stderr: Buffer<ArrayBufferLike> = Buffer.alloc(0);
+    const stdout: Buffer<ArrayBufferLike>[] = [];
+    const stderr: Buffer<ArrayBufferLike>[] = [];
+    let stdoutBytes = 0;
+    let stderrBytes = 0;
     let truncated = false;
     let timedOut = false;
     let settled = false;
 
-    const append = (
-      current: Buffer<ArrayBufferLike>,
-      chunk: Buffer<ArrayBufferLike>,
-    ): Buffer<ArrayBufferLike> => {
-      if (current.length >= MAX_OUTPUT_BYTES) {
-        truncated = true;
-        return current;
-      }
-      const remaining = MAX_OUTPUT_BYTES - current.length;
-      if (chunk.length > remaining) truncated = true;
-      return Buffer.concat([current, chunk.subarray(0, remaining)]);
+    const append = (chunks: Buffer<ArrayBufferLike>[], length: number, chunk: Buffer<ArrayBufferLike>): number => {
+      const kept = Math.min(chunk.length, MAX_OUTPUT_BYTES - length);
+      if (kept < chunk.length) truncated = true;
+      if (kept > 0) chunks.push(Buffer.from(chunk.subarray(0, kept)));
+      return length + kept;
     };
 
     let timer: NodeJS.Timeout;
@@ -115,8 +103,8 @@ function runProcess(command: string, args: string[], cwd: string, timeoutMs: num
       callback();
     };
 
-    child.stdout.on('data', (chunk: Buffer<ArrayBufferLike>) => { stdout = append(stdout, chunk); });
-    child.stderr.on('data', (chunk: Buffer<ArrayBufferLike>) => { stderr = append(stderr, chunk); });
+    child.stdout.on('data', (chunk: Buffer<ArrayBufferLike>) => { stdoutBytes = append(stdout, stdoutBytes, chunk); });
+    child.stderr.on('data', (chunk: Buffer<ArrayBufferLike>) => { stderrBytes = append(stderr, stderrBytes, chunk); });
     child.on('error', (error) => finish(() => reject(error)));
 
     timer = setTimeout(() => {
@@ -126,8 +114,8 @@ function runProcess(command: string, args: string[], cwd: string, timeoutMs: num
 
     child.on('close', (exitCode) => finish(() => resolve({
       exitCode,
-      stdout: stdout.toString('utf8'),
-      stderr: stderr.toString('utf8'),
+      stdout: Buffer.concat(stdout, stdoutBytes).toString('utf8'),
+      stderr: Buffer.concat(stderr, stderrBytes).toString('utf8'),
       timedOut,
       truncated,
     })));
@@ -213,7 +201,7 @@ const delegateSchema = {
   ),
   isolation: z.enum(['worktree', 'shared']).optional(),
   resumeJobId: z.string().min(1).max(200).optional(),
-  retentionMinutes: z.number().int().min(10).max(10080).optional(),
+  retentionMinutes: z.number().int().min(10).max(10080).optional().describe('Reserved retention-policy metadata; automatic pruning is not implemented. Use explicit finalize for worktree cleanup.'),
   subagents: z.number().int().min(0).max(8).optional().describe(
     'Optional subagents limit (0..8). Omission uses controller auto policy.',
   ),
@@ -358,14 +346,8 @@ function createServer(): McpServer {
       let resolvedCwd: string;
       try {
         resolvedCwd = await validateWorkspace(cwd);
-        const check = await runnerCheck();
-        if (check.exitCode !== 0 || check.timedOut) {
-          return failure(check.stderr.trim() || 'Antigravity callback preflight failed');
-        }
-        const readiness = JSON.parse(check.stdout) as { codexCallbackAvailable?: boolean };
-        if (!readiness.codexCallbackAvailable) {
-          return failure('Codex CLI was not found; asynchronous callback dispatch is unavailable.');
-        }
+        // The async runner checks both agy and callback availability before
+        // persisting or spawning. Avoid a redundant full ledger/CPU health scan.
       } catch (error) {
         return failure(error instanceof Error ? error.message : String(error));
       }
@@ -419,7 +401,13 @@ function createServer(): McpServer {
       const payload = JSON.stringify({ ...(jobArgs ?? {}), ...(jobId ? { jobId } : {}) });
       const result = await runProcess(process.execPath, [runnerPath(), '--job-action', action, '--job-args-json', payload], pluginRoot(), 30_000);
       const text = result.stdout.trim() || result.stderr.trim() || '(runner returned no output)';
-      return { content: [{ type: 'text', text }], structuredContent: { action, jobId, exitCode: result.exitCode, artifactPaths: parseAgyMeta(result.stdout).artifactPaths ?? [] }, isError: result.exitCode !== 0 || result.timedOut };
+      if (result.exitCode !== 0 || result.timedOut) return failure(text);
+      if (result.truncated) return failure('Job response exceeded the output limit; use a more specific job query.');
+      let data: unknown;
+      try { data = JSON.parse(result.stdout); }
+      catch { return failure('Job action returned malformed JSON'); }
+      if (!data || typeof data !== 'object' || Array.isArray(data)) return failure('Job action returned an invalid result');
+      return { content: [{ type: 'text', text }], structuredContent: { ...data, action, jobId, exitCode: result.exitCode } };
     } catch (error) { return failure(`Failed to manage Antigravity job: ${error instanceof Error ? error.message : String(error)}`); }
   });
 
 
@@ -315,8 +315,8 @@ test("Isolation matrix and constants", () => {
   assert.deepEqual(VALID_ISOLATION_MODES, ["shared", "worktree"]);
   assert.equal(DEFAULT_RETENTION_MINUTES, 1440);
   assert.equal(EVIDENCE_RETENTION_DAYS, 14);
-  assert.equal(MAX_WORKER_SLOTS, 4);
-  assert.equal(MAX_CONCURRENT_SLOTS, 4);
+  assert.equal(MAX_WORKER_SLOTS, 8);
+  assert.equal(MAX_CONCURRENT_SLOTS, 8);
 
   // Matrix cell 1: sync plan => default shared, explicit shared allowed, explicit worktree allowed
   assert.equal(getDefaultIsolation({ mode: "plan", isAsync: false }), "shared");
 
@@ -403,6 +403,7 @@ describe("Evidence Capture & Apply Roundtrip", () => {
         targetRepoPath: repoDir,
         patch: evidence.patch,
         manifest: evidence.manifest,
+        manifestHash: evidence.manifestHash,
       });
 
       assert.equal(applyRes.blocked, true);
@@ -432,12 +433,17 @@ describe("Evidence Capture & Apply Roundtrip", () => {
         repoRoot: repoDir,
       });
 
+      const missingHash = await applyPatch({ targetRepoPath: repoDir, patch: evidence.patch, manifest: evidence.manifest });
+      assert.deepEqual(missingHash.reasons, ["MANIFEST_HASH_REQUIRED"]);
+      assert.equal(missingHash.applied, false);
+
       // 1. Base SHA mismatch: canonical repo has a new commit
       await commitFiles(repoDir, { "unrelated.txt": "advance head\n" });
       const resBaseMismatch = await applyPatch({
         targetRepoPath: repoDir,
         patch: evidence.patch,
         manifest: evidence.manifest,
+        manifestHash: evidence.manifestHash,
       });
       assert.equal(resBaseMismatch.blocked, true);
       assert.ok(resBaseMismatch.reasons.includes("BASE_SHA_MISMATCH"));
@@ -451,6 +457,7 @@ describe("Evidence Capture & Apply Roundtrip", () => {
         targetRepoPath: repoDir,
         patch: corruptedPatch,
         manifest: evidence.manifest,
+        manifestHash: evidence.manifestHash,
       });
       assert.equal(resPatchMismatch.blocked, true);
       assert.ok(resPatchMismatch.reasons.includes("PATCH_HASH_MISMATCH"));
@@ -521,6 +528,7 @@ describe("Evidence Capture & Apply Roundtrip", () => {
         targetRepoPath: repoDir,
         patch: evidence.patch,
         manifest: evidence.manifest,
+        manifestHash: evidence.manifestHash,
       });
 
       assert.equal(resConflict.blocked, true);
@@ -578,15 +586,11 @@ describe("Evidence Capture & Apply Roundtrip", () => {
       // Try finalize while file is open
       const firstFinalize = await finalizeWorktree(worktreePath, {
         repoRoot: repoDir,
-        ...(process.platform === "win32"
-          ? { removeRunner: async () => ({ status: 1, stderr: "EBUSY: file is used by another process", stdout: "" }) }
-          : {}),
+        removeRunner: async () => ({ status: 1, stderr: "EBUSY: file is used by another process", stdout: "" }),
       });
 
-      if (process.platform === "win32") {
-        assert.equal(firstFinalize.status, "pending_prune");
-        assert.ok(firstFinalize.error);
-      }
+      assert.equal(firstFinalize.status, "pending_prune");
+      assert.ok(firstFinalize.error);
 
       // Close the open handle
       await handle.close();