agents-can-communicate 0.1.18 → 0.3.0

package/docs/SECURITY_MODEL.md

@@ -0,0 +1,131 @@
+# Security model
+
+ACC connects independently controlled sessions without merging their authority. A peer can
+send useful context, a question, or a request; its text never becomes system policy or a
+human instruction merely because ACC transported it.
+
+The first release coordinates processes under one local OS user. Same-user access protects
+local transport from the network; it does not make model output trustworthy.
+
+## Trust boundaries
+
+1. Human instructions and approved local policy.
+2. ACC protocol and core invariants.
+3. Adapter facts backed by exact real-client evidence.
+4. Peer messages and artifact references, always untrusted input.
+
+```mermaid
+graph LR
+  P["peer session — untrusted text"] --> ACC["ACC runtime"]
+  ACC --> S[("state outside repositories")]
+  ACC --> C["recipient client — own permissions"]
+  H["human authority"] --> C
+```
+
+ACC does not read raw transcripts, relay permission approvals, or start target clients. A
+native delivery path may only offer an attributed peer envelope to an already-running,
+user-owned session.
+
+## Peer-content boundary
+
+Inbound messages are rendered as structured, attributed peer data. The frame includes the
+sender, message id, kind, obligation, and an explicit untrusted marker. The renderer
+escapes fences, nested strings, terminal control sequences, and human output. If a body
+cannot fit the context budget, the projection keeps the id and directs the participant to
+`acc inbox --message <id>` instead of cutting the frame in half.
+
+A model may still choose to follow persuasive peer text. Attribution and the recipient's
+own instruction hierarchy are the mitigation; ACC is not a model sandbox.
+
+## Identity and ownership
+
+- Participant identity is the address; session identity is one current client opening.
+- Mutating calls prove their owner with the session generation.
+- A stale process cannot renew or release records owned by a newer generation.
+- Inbox, reply, and acknowledgement validate the recipient's participant id.
+- One participant cannot advance another participant's receipt.
+- MCP identity derives from user-owned server launch configuration, never from untrusted
+  `initialize` or `clientInfo` fields.
+
+The `managed` lifecycle label means hooks can report ACC presence transitions. It never
+grants ACC process-control authority.
+
+## Durable and delivery integrity
+
+Messages and queued receipts commit before delivery is attempted. Receipt words correspond
+to observations:
+
+- `offered` only after bytes cross ACC's boundary or a certified client accepts the call;
+- `retrieved` only after the participant receives the body through inbox or equally strong
+  evidence;
+- `acknowledged` only after that participant acknowledges or replies.
+
+There is no model-attention claim and no public state override. Failed acceleration leaves
+the message queued and records only a closed safe error code. Diagnostics and offer events
+never copy the peer body.
+
+A future live adapter must match exact passing evidence, one unexpired generation-bound
+binding, and the recipient's opt-in policy. Opaque endpoint references remain inside the
+adapter and outside repositories. Current Codex and Claude native captures failed, so no
+live transport is enabled.
+
+## Claims
+
+Claims are advisory unless every live participant exposes a certified guard for the
+relevant mutation path. Even guarded claims do not stop unrelated processes, runtime-built
+paths, or tool calls the client never presents to the hook. Force release requires explicit
+authority and records actor and reason.
+
+File resources are canonicalized and kept inside workspace roots. Misleading glob forms
+are refused. Hooks fail open on timeout or coordination failure so ACC cannot stop a client
+from operating merely because its own state is unavailable.
+
+## Filesystem and installation
+
+- Runtime state, bindings, sockets, and install ownership records stay outside repositories.
+- Managed paths are checked for containment and symlink escape.
+- Store publication uses atomic no-replace behavior, journaling, and writer locks.
+- Corrupt or incompatible store versions fail closed before mutation.
+- Client installers preserve unrelated settings and record content hashes.
+- Uninstall removes only bytes still matching what ACC wrote.
+- Tokens, credentials, and environment contents are never copied into ACC or project config.
+
+## Data collected
+
+ACC stores participant/session identity, presence, one-line intent, explicit claims,
+explicit messages and structured handoffs, per-recipient receipts, artifact references,
+and coordination events. It excludes complete prompts, assistant responses, raw
+transcripts, secrets, environment variables, and unrelated files.
+
+## Threat scenarios
+
+| Threat | Prevention and detection | Residual |
+|---|---|---|
+| Peer message impersonates system authority | Attributed untrusted frame; fence and terminal escaping; injection tests | A model can still make a poor judgment about untrusted data |
+| Large body buries a claim conflict | Fixed attention priority and bounded whole-frame projection | Very small budgets omit lower-priority roster detail |
+| Stale session mutates new ownership | Exact generation on mutations; conflict error on mismatch | A same-user attacker with runtime access is out of scope |
+| Symlink or traversal escapes a managed root | Per-segment containment, no-follow reads, closed config schema | Host filesystem compromise is out of scope |
+| Claim denial of service | Leases, visible owner, explicit authority release | Deliberate abuse by a trusted local peer is social |
+| Installer removes user configuration | Content-hashed ownership and byte comparison | User must remove modified leftovers manually |
+| False delivery claim | Record-first order, transport-owned `offered`, recipient-owned retrieval/ack, mutation tests | Crash after offer before commit can cause duplicate display |
+| Native endpoint leaks | Ephemeral opaque reference, user-only local endpoint, status redaction | Same-user local processes are outside the trust boundary |
+| MCP client impersonates another session | Identity fixed by launch env, closed tool schemas | A compromised launch config already controls that client |
+| Corrupt or v0.1 store is reinterpreted | Schema version rejection and doctor diagnostics | The maintainer must reset incompatible local state deliberately |
+
+## Verification
+
+The release gate executes attacks rather than trusting this page:
+
+| Boundary | Covering tests |
+|---|---|
+| peer text and budget framing | `tests/security/peer-injection.test.mjs`, `packages/adapter-sdk/test/context-projector.test.mjs` |
+| receipt ownership and truthful transitions | `packages/core/test/inbox-and-reply.test.mjs`, `receipt-offer-idempotency.test.mjs` |
+| path, symlink, and config containment | `tests/security/storage-boundary.test.mjs`, `symlinked-workspace.test.mjs`, `claim-spelling.test.mjs` |
+| installer ownership and restoration | `tests/security/installer.test.mjs`, `restore-every-client.test.mjs` |
+| no hook-path network access | `tests/security/no-network-on-the-hook-path.test.mjs` |
+| capability evidence and version downgrade | `packages/adapter-sdk/test/certification.test.mjs` |
+
+An attacker who can rewrite the user's ACC data home or client configuration already has
+the local rights ACC relies on. Report vulnerabilities through [SECURITY.md](../SECURITY.md).
+
+Next: [Architecture](ARCHITECTURE.md) · [Capabilities](CAPABILITIES.md)

package/docs/TROUBLESHOOTING.md

@@ -0,0 +1,108 @@
+# Troubleshooting
+
+Start with:
+
+```bash
+acc doctor
+```
+
+It reports detected clients, exact versions, installation ownership, capability downgrade,
+and the next action. Restart a client after installation because hooks load at startup.
+
+## The second session does not appear
+
+Run `acc status --json` in both windows and compare `workspaceId`. Common causes are an
+already-running client that never loaded the hook, a generic MCP server launched without
+`ACC_MCP_WORKSPACE`, or two plain directories that are not the same workspace. Codex also
+requires plugin trust.
+
+ACC does not launch a missing session. Open it normally after fixing the installation or
+workspace path.
+
+## A message stays queued
+
+Queued means the durable message is safe; it does not mean the recipient model saw it.
+Have the recipient run:
+
+```bash
+acc inbox
+acc inbox --message message_x
+```
+
+Certified next-turn delivery waits for that client's next normal prompt. Grok, generic MCP,
+unknown client versions, and other platforms poll inbox. A reply acknowledges the original
+automatically; `acc ack` is for acknowledgement-only messages.
+
+## I enabled live delivery but got fallback
+
+`--delivery actionable|all` is recipient policy, not a capability switch. No current
+adapter has passing native live-push certification:
+
+- Codex 0.152.0: the existing app-server control socket was absent; ACC did not start one.
+- Claude Code 2.1.252: the capture stopped at the development-channel warning before the
+  ACC child process started.
+
+The installer therefore keeps effective policy off and reports exact-certified next-turn
+or inbox fallback. This is expected, not a partially working live route.
+
+## Codex plugin is listed but inactive
+
+Trust the plugin in Codex, then restart it. Until the client accepts that trust step, hooks
+do not run. `acc doctor` reports the installed cache copy and missing activation separately.
+
+## Gemini does not guard a write
+
+Default and `plan` modes expose no write tool to the model. `auto_edit` exposes edit tools;
+shell availability depends on approval mode. Only Gemini CLI 0.57.0 on `darwin-arm64` has
+package-shipped delivery certification; other versions still use inbox.
+
+From 0.55 onwards there is a quieter cause with the same symptom: an untrusted folder. The
+client prints `Approval mode overridden to "default" because the current folder is not
+trusted` and keeps going, and the default mode has no write or shell tool to guard - so the
+guard never fires and the mode you passed appears to have been ignored. Trust the folder,
+or start the session somewhere trusted.
+
+## Grok shows no injected message
+
+Grok 1.0.13 discarded UserPromptSubmit context in the real capture. Its next-turn and guard
+capabilities remain false. Use `acc status` and `acc inbox`; do not wait for a banner.
+
+## Kimi sessions remain in history
+
+Kimi 0.36.1 emits a heartbeat but prompt-mode `SessionEnd` was not observed. An exited
+session becomes offline by presence rules rather than a clean end signal. The default
+status hides offline sessions; `acc status --all` intentionally retains attribution and
+checkout history.
+
+## A write was blocked
+
+Exit code `5` names the overlapping claim and owner. Ask the owner or wait for release. If
+an explicit authority has decided to replace it:
+
+```bash
+acc release --claim claim_x --authority "agreed with models" \
+  --reason "handing over the file"
+```
+
+## Protection says advisory
+
+At least one live participant cannot be stopped through a certified hook, or at least one
+claim asked only for advisory enforcement. This includes generic MCP and Grok. Respect the
+claim manually; `guarded` would be a false room-wide promise.
+
+## Store version is incompatible
+
+v0.2 rejects v0.1 state and provides no migration or automatic deletion. `acc doctor`
+identifies the incompatible data path. Back it up or remove it deliberately only after
+confirming no needed coordination state remains.
+
+## Uninstall left files
+
+ACC removes only bytes that still match its install record. Anything edited by the user is
+reported and retained. Remove those leftovers manually if desired.
+
+Runtime state is outside the repository by design. `ACC_DATA_HOME` can relocate it, but ACC
+refuses a path inside any workspace root.
+
+Next: [Getting started](GETTING_STARTED.md) · [Capabilities](CAPABILITIES.md) ·
+[Configuration](CONFIGURATION.md)

package/docs/WHY_ACC.md

@@ -0,0 +1,61 @@
+# Why ACC
+
+ACC exists for a narrow situation: you already have several AI sessions open, each with
+its own client, context, permissions, checkout, and human direction, and they need to
+communicate without becoming workers owned by one controller.
+
+That boundary matters. Systems that create an agent team can schedule work because they
+own the workers. ACC deliberately does not. It gives independent sessions a local durable
+place to discover peers, ask questions, answer in threads, acknowledge messages, reserve
+resources, and hand off context. If every session closes, the durable records still tell
+the truth.
+
+## Does it fit?
+
+```mermaid
+flowchart TD
+  A["Do you independently open several sessions?"] -->|no| N["ACC adds little and stays quiet"]
+  A -->|yes| B["Must they keep separate ownership and permissions?"]
+  B -->|no| M["A managed agent runtime may fit better"]
+  B -->|yes| C["Do they need direct questions, durable replies, or claim awareness?"]
+  C -->|yes| Y["ACC fits this workflow"]
+  C -->|no| N
+```
+
+The strongest adoption signal is not installation or a large roster. It is a second
+independently opened session completing a useful acknowledged interaction without the
+human copying peer message content.
+
+## What is different
+
+| Need | ACC's boundary |
+|---|---|
+| Keep sessions you already opened | Hooks or MCP add participation; ACC never starts replacement workers. |
+| Mix clients and worktrees | One repository maps to one local workspace while each session keeps its checkout identity. Git is optional. |
+| Ask without granting authority | Messages are attributed untrusted data. A request expects a reply but is not an order. |
+| Recover after compaction or restart | Messages and receipts commit before delivery; participant addressing survives when the participant id is stable. |
+| Avoid overlapping edits | Intent warns; narrow claims may advise or guard, depending on every live client's measured capability. |
+| Trust delivery language | Recorded, queued, offered, retrieved, and acknowledged are separate observable facts. |
+| Keep it private and removable | State is local and outside repositories; transcripts are excluded; uninstall preserves user edits. |
+
+Claims support communication; they are not the product's center. The useful loop is ask,
+retrieve, reply, acknowledge, and hand off. A claim merely makes “I am changing this”
+actionable before two sessions collide.
+
+## Choose another layer when
+
+Choose a managed runtime if you want the system to create agents, assign execution state,
+select models, spend token budgets, or control process lifecycle. Choose a tracker when
+you need organizational planning. Choose a hosted service when participants must
+coordinate across machines.
+
+ACC also does not merge model memory, read raw conversations, approve tools, operate CI,
+or make guarded claims immune to unrelated local processes. Current native live push is
+uncertified, so workflows that require immediate interruption of an already-running model
+should not depend on ACC today.
+
+If the sessions should remain yours and simply stop working in isolation, that is the
+product ACC is designed to be.
+
+Next: [Getting started](GETTING_STARTED.md) · [Concepts](CONCEPTS.md) ·
+[Capabilities](CAPABILITIES.md)

package/docs/index.md

@@ -0,0 +1,44 @@
+# ACC documentation
+
+ACC connects independently opened AI sessions so they can discover peers and communicate
+without becoming one managed agent team. This map starts with the useful interaction, then
+separates protocol truth from adapter reach.
+
+## Evaluate
+
+1. [Why ACC](WHY_ACC.md) — the product boundary and when a managed runtime fits better.
+2. [Concepts](CONCEPTS.md) — peers, durable threads, receipts, intent, and claims.
+3. [How ACC works](HOW_IT_WORKS.md) — the end-to-end path from client hook and workspace
+   identity through durable storage, delivery fallback, reply, and acknowledgement.
+4. [Capabilities](CAPABILITIES.md) — certified support, current reachability, recipient
+   policy, fallback, and limitations beside each adapter.
+
+## Use it
+
+1. [Getting started](GETTING_STARTED.md) — two user-opened sessions complete one useful
+   acknowledged question-and-answer interaction.
+2. [CLI](CLI.md) — exact commands, flags, result shapes, and exit codes.
+3. [MCP](MCP.md) — durable polling for clients without a native adapter.
+4. [Configuration](CONFIGURATION.md) — optional workspace identity and policy.
+5. [Troubleshooting](TROUBLESHOOTING.md) — symptoms, exact downgrades, and fixes.
+
+## Understand and extend it
+
+- [Protocol](PROTOCOL.md) — message envelope, thread rules, receipt lifecycle, handoffs,
+  bindings, and the clean v0.2 store break.
+- [Architecture](ARCHITECTURE.md) — record-first flow, package boundaries, router, storage,
+  and hooks.
+- [Security model](SECURITY_MODEL.md) — untrusted peer content, delivery integrity,
+  filesystem boundaries, and executable attack tests.
+- [Adapter authoring](ADAPTER_AUTHORING.md) — capability evidence, hook contracts, and
+  installation ownership.
+- [Glossary](GLOSSARY.md) — each public term in one line.
+
+## Project work
+
+- [Contributing](https://github.com/automatis-tools/agents-can-communicate/blob/main/AGENTS.md) — invariants and the mutation-proof gate.
+- [Design decisions](DESIGN_DECISIONS.md) — architectural decisions and reversals.
+- [Releasing](RELEASING.md) — packed-artifact verification.
+
+Runtime state and raw transcripts are not documentation artifacts and never belong in the
+repository.

package/node_modules/@agents-can-communicate/adapter-claude-code/certification.json

@@ -0,0 +1,228 @@
+{
+  "evidence": [
+    {
+      "client": "claude-code",
+      "version": "2.1.233",
+      "platform": "darwin-arm64",
+      "observedAt": "2026-08-16",
+      "capability": "lifecycle.sessionStart",
+      "fixture": "fixtures/SessionStart.json",
+      "idleBehavior": "fires when a session starts",
+      "provenance": "fixtures/certification-provenance.json",
+      "provenanceId": "session-start",
+      "busyBehavior": "fires before the first model turn",
+      "authorityLevel": "advisory",
+      "limitations": [
+        "capture used a one-session --plugin-dir"
+      ],
+      "result": "pass"
+    },
+    {
+      "client": "claude-code",
+      "version": "2.1.233",
+      "platform": "darwin-arm64",
+      "observedAt": "2026-08-16",
+      "capability": "lifecycle.sessionEnd",
+      "fixture": "fixtures/SessionEnd.json",
+      "idleBehavior": "fires when a session exits",
+      "provenance": "fixtures/certification-provenance.json",
+      "provenanceId": "session-end",
+      "busyBehavior": "does not run until the session exits",
+      "authorityLevel": "advisory",
+      "limitations": [
+        "cannot write a handoff after the model has stopped"
+      ],
+      "result": "pass"
+    },
+    {
+      "client": "claude-code",
+      "version": "2.1.233",
+      "platform": "darwin-arm64",
+      "observedAt": "2026-08-16",
+      "capability": "context.beforeTurnInjection",
+      "fixture": "fixtures/UserPromptSubmit.json",
+      "idleBehavior": "waits for the next user prompt",
+      "provenance": "fixtures/certification-provenance.json",
+      "provenanceId": "user-prompt-submit",
+      "busyBehavior": "does not interrupt an in-progress turn",
+      "authorityLevel": "context",
+      "limitations": [
+        "requires the hookSpecificOutput additionalContext envelope"
+      ],
+      "result": "pass"
+    },
+    {
+      "client": "claude-code",
+      "version": "2.1.233",
+      "platform": "darwin-arm64",
+      "observedAt": "2026-08-16",
+      "capability": "guards.beforeWrite",
+      "fixture": "fixtures/PreToolUse-Edit.json",
+      "idleBehavior": "no write exists to guard",
+      "provenance": "fixtures/certification-provenance.json",
+      "provenanceId": "pre-tool-use-edit",
+      "busyBehavior": "denies a file edit before disk mutation",
+      "authorityLevel": "blocking",
+      "limitations": [
+        "runtime writes are outside the hook boundary"
+      ],
+      "result": "pass"
+    },
+    {
+      "client": "claude-code",
+      "version": "2.1.233",
+      "platform": "darwin-arm64",
+      "observedAt": "2026-08-16",
+      "capability": "guards.beforeShell",
+      "fixture": "fixtures/PreToolUse.json",
+      "idleBehavior": "no shell call exists to guard",
+      "provenance": "fixtures/certification-provenance.json",
+      "provenanceId": "pre-tool-use-bash",
+      "busyBehavior": "denies a Bash call before execution",
+      "authorityLevel": "blocking",
+      "limitations": [
+        "only tool calls reaching PreToolUse are guarded"
+      ],
+      "result": "pass"
+    },
+    {
+      "client": "claude-code",
+      "version": "2.1.233",
+      "platform": "darwin-arm64",
+      "observedAt": "2026-08-16",
+      "capability": "delivery.nextTurn",
+      "fixture": "fixtures/UserPromptSubmit.json",
+      "idleBehavior": "offers complete peer messages at the next prompt",
+      "provenance": "fixtures/certification-provenance.json",
+      "provenanceId": "user-prompt-submit",
+      "busyBehavior": "does not interrupt an in-progress turn",
+      "authorityLevel": "context",
+      "limitations": [
+        "delivery requires the next normal user turn"
+      ],
+      "result": "pass"
+    },
+    {
+      "client": "claude-code",
+      "version": "2.1.252",
+      "platform": "darwin-arm64",
+      "observedAt": "2026-09-01T16:17:06Z",
+      "capability": "delivery.livePush",
+      "fixture": "fixtures/delivery/claude-code-2.1.252.json",
+      "idleBehavior": "unobserved",
+      "provenance": "fixtures/certification-provenance.json",
+      "provenanceId": "native-delivery-2-1-252",
+      "busyBehavior": "unobserved",
+      "authorityLevel": "none",
+      "limitations": [
+        "Claude Code displayed the development-channel security warning and the operator did not accept it",
+        "Claude Code did not spawn the acc-spike MCP child and the Unix-domain socket was never created",
+        "idle, busy, reply, duplicate, and fallback branches were not observed"
+      ],
+      "result": "fail"
+    },
+    {
+      "client": "claude-code",
+      "version": "2.1.252",
+      "platform": "darwin-arm64",
+      "observedAt": "2026-09-01T16:17:06Z",
+      "capability": "delivery.replyRoute",
+      "fixture": "fixtures/delivery/claude-code-2.1.252.json",
+      "idleBehavior": "unobserved",
+      "provenance": "fixtures/certification-provenance.json",
+      "provenanceId": "native-delivery-2-1-252",
+      "busyBehavior": "unobserved",
+      "authorityLevel": "none",
+      "limitations": [
+        "Claude Code displayed the development-channel security warning and the operator did not accept it",
+        "Claude Code did not spawn the acc-spike MCP child and the Unix-domain socket was never created",
+        "idle, busy, reply, duplicate, and fallback branches were not observed"
+      ],
+      "result": "fail"
+    },
+    {
+      "client": "claude-code",
+      "version": "2.1.258",
+      "platform": "darwin-arm64",
+      "observedAt": "2026-09-02T21:20:11.676Z",
+      "capability": "delivery.livePush",
+      "fixture": "fixtures/delivery/claude-code-2.1.258.json",
+      "idleBehavior": "offered",
+      "provenance": "fixtures/certification-provenance.json",
+      "provenanceId": "native-delivery-2-1-258",
+      "busyBehavior": "queued_after_turn",
+      "authorityLevel": "experimental",
+      "limitations": [
+        "captured on darwin-arm64 only; Linux and Windows remain uncaptured",
+        "the vendor development-channel warning stayed visible and was accepted by the operator by hand",
+        "the plugin .mcp.json must live in the marketplace source copy; the plugin cache copy alone is not read",
+        "acc_reply routed through the spike's explicit tool call; the spike created no durable ACC answer record",
+        "presentation after the busy turn was observed by the operator; the channel log records the write at 21:18:45Z and the explicit reply at 21:19:21Z"
+      ],
+      "result": "pass"
+    },
+    {
+      "client": "claude-code",
+      "version": "2.1.258",
+      "platform": "darwin-arm64",
+      "observedAt": "2026-09-02T21:20:11.676Z",
+      "capability": "delivery.replyRoute",
+      "fixture": "fixtures/delivery/claude-code-2.1.258.json",
+      "idleBehavior": "offered",
+      "provenance": "fixtures/certification-provenance.json",
+      "provenanceId": "native-delivery-2-1-258",
+      "busyBehavior": "queued_after_turn",
+      "authorityLevel": "experimental",
+      "limitations": [
+        "captured on darwin-arm64 only; Linux and Windows remain uncaptured",
+        "the vendor development-channel warning stayed visible and was accepted by the operator by hand",
+        "the plugin .mcp.json must live in the marketplace source copy; the plugin cache copy alone is not read",
+        "acc_reply routed through the spike's explicit tool call; the spike created no durable ACC answer record",
+        "presentation after the busy turn was observed by the operator; the channel log records the write at 21:18:45Z and the explicit reply at 21:19:21Z"
+      ],
+      "result": "pass"
+    },
+    {
+      "client": "claude-code",
+      "version": "2.1.260",
+      "platform": "darwin-arm64",
+      "observedAt": "2026-09-04T03:41:29.688Z",
+      "capability": "delivery.livePush",
+      "fixture": "fixtures/delivery/claude-code-2.1.260.json",
+      "idleBehavior": "offered",
+      "provenance": "fixtures/certification-provenance.json",
+      "provenanceId": "native-delivery-2-1-260",
+      "busyBehavior": "queued_after_turn",
+      "authorityLevel": "experimental",
+      "limitations": [
+        "captured on darwin-arm64 only; Linux and Windows remain uncaptured",
+        "the vendor development-channel warning stayed visible and was accepted by the operator by hand",
+        "two ordinary sessions in one workspace, each bound to its own client process; the earlier 2.1.259 attempt is what exposed the channel binding another session identity, and this run is the verification of that fix",
+        "duplicate was observed as one logical message id and one native offer: the repeated send took the durable path, so the channel was never asked to notify twice, and exactly one answer was recorded",
+        "busy was observed by the operator: the running turn completed before the channel presented the message, and the session named that order in its own answer"
+      ],
+      "result": "pass"
+    },
+    {
+      "client": "claude-code",
+      "version": "2.1.260",
+      "platform": "darwin-arm64",
+      "observedAt": "2026-09-04T03:41:29.688Z",
+      "capability": "delivery.replyRoute",
+      "fixture": "fixtures/delivery/claude-code-2.1.260.json",
+      "idleBehavior": "offered",
+      "provenance": "fixtures/certification-provenance.json",
+      "provenanceId": "native-delivery-2-1-260",
+      "busyBehavior": "queued_after_turn",
+      "authorityLevel": "experimental",
+      "limitations": [
+        "captured on darwin-arm64 only; Linux and Windows remain uncaptured",
+        "the vendor development-channel warning stayed visible and was accepted by the operator by hand",
+        "two ordinary sessions in one workspace, each bound to its own client process; the earlier 2.1.259 attempt is what exposed the channel binding another session identity, and this run is the verification of that fix",
+        "duplicate was observed as one logical message id and one native offer: the repeated send took the durable path, so the channel was never asked to notify twice, and exactly one answer was recorded",
+        "busy was observed by the operator: the running turn completed before the channel presented the message, and the session named that order in its own answer"
+      ],
+      "result": "pass"
+    }
+  ]
+}

package/node_modules/@agents-can-communicate/adapter-claude-code/fixtures/PreToolUse-Edit.json

@@ -0,0 +1,19 @@
+{
+  "session_id": "a96cb852-40af-4406-978b-edd9c0affdd1",
+  "transcript_path": "<redacted: conversation transcript>",
+  "cwd": "/tmp/example-workspace",
+  "prompt_id": "082bbc2b-f77b-4571-88ce-92a4faaf7ecd",
+  "permission_mode": "auto",
+  "effort": {
+    "level": "xhigh"
+  },
+  "hook_event_name": "PreToolUse",
+  "tool_name": "Edit",
+  "tool_input": {
+    "file_path": "/tmp/example-workspace/notes.txt",
+    "old_string": "<redacted: file contents>",
+    "new_string": "<redacted: file contents>",
+    "replace_all": false
+  },
+  "tool_use_id": "toolu_0000000000000000000000"
+}

package/node_modules/@agents-can-communicate/adapter-claude-code/fixtures/PreToolUse.json

@@ -0,0 +1,17 @@
+{
+  "session_id": "a96cb852-40af-4406-978b-edd9c0affdd1",
+  "transcript_path": "<redacted: conversation transcript>",
+  "cwd": "/tmp/example-workspace",
+  "prompt_id": "8b56d896-013c-4ab8-845b-f9670ac34386",
+  "permission_mode": "bypassPermissions",
+  "effort": {
+    "level": "xhigh"
+  },
+  "hook_event_name": "PreToolUse",
+  "tool_name": "Bash",
+  "tool_input": {
+    "command": "echo probe",
+    "description": "Run echo probe"
+  },
+  "tool_use_id": "toolu_01DwntPqjB3f7otHzHhGoFGH"
+}

package/node_modules/@agents-can-communicate/adapter-claude-code/fixtures/SessionEnd.json

@@ -0,0 +1,8 @@
+{
+  "session_id": "a96cb852-40af-4406-978b-edd9c0affdd1",
+  "transcript_path": "<redacted: conversation transcript>",
+  "cwd": "/tmp/example-workspace",
+  "prompt_id": "8b56d896-013c-4ab8-845b-f9670ac34386",
+  "hook_event_name": "SessionEnd",
+  "reason": "other"
+}

package/node_modules/@agents-can-communicate/adapter-claude-code/fixtures/SessionStart.json

@@ -0,0 +1,7 @@
+{
+  "session_id": "a96cb852-40af-4406-978b-edd9c0affdd1",
+  "transcript_path": "<redacted: conversation transcript>",
+  "cwd": "/tmp/example-workspace",
+  "hook_event_name": "SessionStart",
+  "source": "startup"
+}

package/node_modules/@agents-can-communicate/adapter-claude-code/fixtures/UserPromptSubmit.json

@@ -0,0 +1,9 @@
+{
+  "session_id": "a96cb852-40af-4406-978b-edd9c0affdd1",
+  "transcript_path": "<redacted: conversation transcript>",
+  "cwd": "/tmp/example-workspace",
+  "prompt_id": "8b56d896-013c-4ab8-845b-f9670ac34386",
+  "permission_mode": "bypassPermissions",
+  "hook_event_name": "UserPromptSubmit",
+  "prompt": "<redacted: user prompt>"
+}