Epic: ACP release-caveat closeout and live verification tracker

[rmusser01]

Parent context

The original ACP productionization tracker (#1471), readiness matrix (#1472), compatibility/certification matrix (#1539), and narrowed OSS/custom certification tracker (#1563) are closed. This issue tracks the remaining ACP release caveats that are still documented but no longer have an open execution tracker.

Goal

Close the gap between caveated ACP support and release-grade evidence for the currently shipped ACP stack. This should not reopen broad ACP productionization. It should track narrow, verifiable release-caveat work only.

Current known caveats

• Final live-backend ACP browser E2E still needs a seeded backend/API-key run rather than only mocked UI coverage.
• Go runner verification should be refreshed against current dev before release claims.
• Artifact retention and transcript redaction policy need an explicit release decision.
• Host-specific sandbox backend verification is still caveated unless a target runtime is selected and validated.
• Goose, Hermes, and OpenCode are supported_with_caveats / live_e2e_tested for verified host profiles, but deeper scenarios remain unverified: non-empty MCP injection, artifact-producing workflows, reviewer-loop behavior, and failure diagnostic payloads.
• Aider, Continue, and generic custom profiles remain conservative/documented-only unless future concrete evidence changes their support state.

Workstreams

• Live backend E2E closeout for ACP Playground, Agent Registry, and Agent Tasks.
• Go runner verification refresh.
• Artifact retention and transcript redaction policy.
• Sandbox host runtime verification.
• Deeper live-agent certification caveats for Goose/Hermes/OpenCode.
• Conservative status guardrails for Aider/Continue/custom profiles.

Acceptance criteria

• Each release caveat has either a closed child issue with evidence or an explicit accepted-release-skip note.
• ACP readiness and operator docs agree with the final evidence state.
• Compatibility/setup surfaces continue to use conservative language for unsupported or documented-only agents.
• Any release claim for ACP support distinguishes stub, host-stdio live E2E, backend live E2E, sandbox, artifact, reviewer-loop, and failure-diagnostics evidence.
• This tracker is closed only after child issue outcomes are reconciled in docs and setup/registry surfaces.

[rmusser01]

Child issue map created on 2026-06-19:

• ACP release caveat: live-backend browser E2E closeout #2404 ACP release caveat: live-backend browser E2E closeout
• ACP release caveat: Go runner verification refresh #2403 ACP release caveat: Go runner verification refresh
• ACP release caveat: artifact retention and transcript redaction policy #2401 ACP release caveat: artifact retention and transcript redaction policy
• ACP release caveat: sandbox host-runtime verification #2400 ACP release caveat: sandbox host-runtime verification
• ACP live-agent caveat: deeper Goose, Hermes, and OpenCode certification scenarios #2402 ACP live-agent caveat: deeper Goose, Hermes, and OpenCode certification scenarios
• ACP support guardrail: preserve conservative Aider, Continue, and custom-profile status #2399 ACP support guardrail: preserve conservative Aider, Continue, and custom-profile status

Suggested execution order:

1. ACP release caveat: live-backend browser E2E closeout #2404 live-backend browser E2E closeout, because it validates the user-facing ACP path end to end.
2. ACP release caveat: Go runner verification refresh #2403 Go runner verification refresh, because it is a fast release gate and catches runner regressions.
3. ACP release caveat: artifact retention and transcript redaction policy #2401 retention/redaction policy, because it defines what release notes and diagnostics can safely claim.
4. ACP live-agent caveat: deeper Goose, Hermes, and OpenCode certification scenarios #2402 deeper live-agent caveats, because these rely on the live-backend and policy baseline.
5. ACP release caveat: sandbox host-runtime verification #2400 sandbox runtime verification, unless a sandbox-backed release claim is planned sooner.
6. ACP support guardrail: preserve conservative Aider, Continue, and custom-profile status #2399 conservative support guardrail as a low-risk audit, or earlier if setup/registry copy changes during any other ACP slice.

[rmusser01]

Child issue #2404 is complete and closed: #2404 (comment)

Live-backend ACP browser E2E result: 20 passed (29.6s) across ACP Playground, Agent Registry, Agent Tasks, and the Research Workspace ACP run-history diagnostics path.

Important release/operator note from the closeout: the reproducible gate must use the bundled runner home from Config_Files/config.txt (runner_env = HOME=./acp_runner_home,PYTHONUNBUFFERED=1). Overriding ACP_RUNNER_ENV to host HOME bypasses the bundled runner registry and can make dispatch fail with unknown agent type: opencode even though the server registry advertises OpenCode.

No app-code changes were required for this workstream; this closes only the live-backend browser E2E caveat. Remaining child workstreams on this epic stay open.

[rmusser01]

Child issue #2403 is complete and closed: #2403 (comment)

Go runner verification refresh result: tools/tldw-agent/scripts/verify-local-build.sh passed on macOS 15.6 (24G84) with go version go1.26.2 darwin/arm64 at commit 1aa093ee7a752f1cad8c9e9d62a318b96a4dbec8. Explicit host/ACP binary builds and go test ./... also passed.

No failures were observed, so no code regression, host prerequisite blocker, or accepted release skip is needed for this workstream. No app-code changes were required; this closes only the Go runner verification refresh caveat.

[rmusser01]

ACP release-caveat tracker update for #2401:

• PR: Document ACP retention and redaction release policy #2409
• Follow-up split out: ACP support-safe task run summaries for Agent Tasks previews #2408 for support-safe task run summaries in Agent Tasks previews
• Policy now explicitly covers ACP session transcripts, event drill-through, session artifacts, diagnostics, audit records, Agent Tasks transcript previews, promoted workspace artifacts, redaction guarantees, and known non-guarantees.

Verification recorded in the PR: git diff --check, targeted rg consistency checks, and docs-only Bandit skip rationale.