ci / vet-and-test (pull_request) Successful in 41s
Why: N1 increment three host side - plugin agent assets must reject hooks/mcp/permissionMode declarations (WP1 acceptance), and squad members need the kernel ask port wired to the HITL card (WP4). Evidence: go vet clean; go test ./... 29 packages ok, including new agent-asset tests (banned keys located to the field, unknown keys, missing id) and the V2 asset suite. Nested pins at native c5b9dca (PR #18) and squad fc9620e (PR #17). Impact: plugins agents/ assets now parse via parseAgentAsset (strict JSON with banned-key rejection); PermissionAskOf exported and takes any host with the optional method; app.go wires cfg.PermissionAsk for the squad path. Legacy behavior unchanged when nothing registers the port. Refs: Documents proposal 2026-10-07-agent-stack-n1q1i1-plans.md WP1/WP4