agents-can-communicate 0.7.1 → 0.8.1

package/docs/CAPABILITIES.md

@@ -4,7 +4,8 @@ Use this page to set expectations after installation. Integration means ACC can
 peer awareness and coordination instructions; it does not guarantee what a model will do
 with them. Delivery also varies independently from awareness. The durable inbox works for
 every participant, a client at or after a captured version may add next-turn delivery, and the
-experimental Codex LocalDaemon and Claude Code Channel paths can deliver while a session is idle.
+experimental Codex LocalDaemon, Claude Code inbox wake and Antigravity CLI relay paths can
+deliver while a session is idle.
 
 Capability honesty separates four questions that are easy to collapse:
 
@@ -19,9 +20,9 @@ Capability honesty separates four questions that are easy to collapse:
 A source method or vendor documentation is not certification. A capture applies forward: from
 the version that recorded it until a later capture changes that capability, and to every
 platform until one of them records something of its own. A client older than every capture
-degrades to false, and so does a capability a capture recorded as failing. Native
-minimum-based eligibility is separate, and stays per-platform. No weaker session inherits a
-stronger peer's capability.
+degrades to false, and so does a capability a capture recorded as failing. Native live
+delivery reads its captured minimum the same way: on every platform, with a prerelease judged
+by its release triple. No weaker session inherits a stronger peer's capability.
 
 Run `acc doctor` in the project when observed behavior differs from this page. It reports
 the installed client version, platform, effective capability, and fallback instead of
@@ -50,11 +51,21 @@ child sessions, startup or safe-point injection, and before-read guards.
 
 The native rows are `no` at the hook versions this matrix names.
 Separate installed-client captures establish Codex `livePush` on 0.152.1 and
-0.153.4, Claude Code `livePush` plus `replyRoute` on 2.1.258 and 2.1.260, and
+0.153.4, Claude Code `livePush` on 2.1.282 through the session inbox, and
 Antigravity CLI `livePush` on 1.2.7 and later through a relay the agent starts in its own shell.
-Native eligibility uses the captured platform minimum, a current feature probe,
-and an exact per-session handshake. It is experimental and requires recipient
-opt-in. Codex and Antigravity CLI reply through `acc reply`; their native `replyRoute` remains false.
+Native eligibility uses the captured minimum, a current feature probe, and an exact
+per-session handshake. It is experimental and requires recipient opt-in.
+
+What may refuse live delivery is exactly three things:
+
+- the machine's own probe or per-session handshake failing;
+- a client older than the first passing capture;
+- a regression recorded in `knownBad`.
+
+Nothing else: not the platform, not a prerelease suffix, not where the evidence was taken.
+A platform whose transport is technically different is refused by the probe as a fact about
+that transport, which is what Claude Code's named pipe on native Windows is. Codex, Claude Code and Antigravity CLI reply through `acc reply`. Their native
+`replyRoute` remains false.
 
 The limitations belong next to the adapters they affect:
 
@@ -62,7 +73,7 @@ The limitations belong next to the adapters they affect:
 |---|---|
 | Antigravity CLI | 1.2.7 on darwin-arm64, captured in print mode, and every later release by the forward rule. Only `SessionStart`, `PreInvocation`, `PostInvocation` and `Stop` load; `SessionEnd`, `PreToolUse` and `PostToolUse` are accepted into the config file and silently dropped, so there is no tool guard and no session-end deregistration - a session goes offline by presence age or an explicit `acc finish`. Payloads carry no `hook_event_name`, so each registered command passes its own event name. The end-of-turn `Stop` continuation reaches the model and is a bounded nudge, not a gate: ACC continues a turn at most once and fails open, and the client caps consecutive continuations itself (vendor 1.1.9). `agy agentapi send-message` can wake an idle session - captured - but only with that session's language-server address and CSRF token, which exist in the agent's own shell and in no hook. ACC does not take that token, so live push and reply routing are false. A peer message that arrives while the model writes its last answer is carried by the `Stop` continuation instead. A write that parses can register nothing, so install and doctor read `agy -p "/hooks"` back instead of trusting the file. Live push (1.2.7, darwin-arm64, TUI only, experimental, recorded opt-in) runs through a relay the agent starts once per conversation from its own shell - the only process holding the session endpoint - after ACC's context asks it to, up to three times while none is serving; the operator approves that command at the client's permission prompt. An idle session wakes; a busy one sees the message after its running answer, or at the next model invocation when the turn waits on a tool. Print mode and the first session in a folder trusted at that launch get no relay. |
 | Codex | Next-turn context, captured on 0.147.0, requires plugin trust. The observed stock 0.153.4 upgrade from ACC 0.3.1 to 0.4 required fresh review of five modified hook definitions; a subsequent restart retained all five active (activation evidence, not new event certification). LocalDaemon native delivery was captured through the installed package on 0.152.1 and 0.153.4, darwin-arm64; minimum 0.152.1, recorded opt-in, current feature probe and exact thread/cwd/process/version/protocol checks are required. Ordinary launch preserves the receiver workspace without ACC arguments or daemon ownership. Embedded or unreachable sessions keep their inbox. Native `replyRoute` remains false. |
-| Claude Code | 2.1.233 next-turn delivery waits for the next user prompt. A 2.1.258 Channel capture proved idle offer, busy queue-after-turn, explicit reply, duplicate suppression, and durable fallback, so `delivery.livePush` and `delivery.replyRoute` are live capabilities behind the native contract (experimental, off until opted in; Claude's development-channel warning is vendor-owned and visible). |
+| Claude Code | 2.1.233 next-turn delivery waits for the next user prompt. From 2.1.282, captured on darwin-arm64 and applied on every platform whose inbox is a Unix socket, `delivery.livePush` is a live capability behind the native contract (experimental, off until opted in). ACC wakes the session through the inbox socket that Claude Code opens for every session, with one line of fixed ACC text and the message id. An idle session starts a turn. A busy session takes the wake between two tool calls. Each delivered wake fires `UserPromptSubmit`, so the next-turn hook shows the body and records the receipt `offered` via `next-turn`. The model answers with `acc reply`, so `delivery.replyRoute` stays false. A session in `bypassPermissions` mode holds each wake for approval unless `crossSessionInbound` is `accept`, and `refuse` drops wakes. Native Windows keeps next-turn delivery: its inbox is a named pipe that requires an auth line, and it is uncaptured. Linux is uncaptured. |
 | Gemini CLI | Package-shipped next-turn certification starts at 0.57.0. Its TUI has no captured external wake or queue interface and `--acp` changes launch ownership, so native delivery is fallback-only; live push and reply routing remain false. |
 | Grok | The Grok 1.0.24 installed-client check observed own CLI arguments after a terminal result, followed by owned work, message, and finish calls. This identity-only path does not certify peer-context injection. Documentation-shaped payloads do not count as real captures. The public leader surface exposed no proven addressed injection into an ordinary TUI session, so native delivery is `awaiting_compatibility_capture`; all capabilities remain false. |
 | Kimi Code | Next-turn and guard evidence was captured on 0.36.1, plus a 60-second heartbeat. Its server/queue APIs do not prove a transparent binding to an independently opened session, so native delivery is fallback-only. |
@@ -81,19 +92,21 @@ with a computed `reachable` boolean while keeping the opaque endpoint private.
 The router requires exactly one current eligible generation. No binding, several live
 sessions for one participant, and an adapter refusal keep delivery on the durable
 fallback. An expired lease may be revalidated by an adapter's optional refresh method;
-failure leaves the message queued. Busy behavior belongs to the transport: Claude's Channel can accept a
-message while the target is busy and queue it until the current turn finishes; an adapter
-that instead refuses with `recipient_busy` leaves the message on the durable path.
+failure leaves the message queued. Busy behavior belongs to the transport. Codex accepts a
+message while the target is busy and holds it until the current turn finishes. Claude Code
+takes a wake between two tool calls of the running turn. An adapter that instead refuses
+with `recipient_busy` leaves the message on the durable path.
 
 An endpoint may renew its lease, or an adapter may revalidate that exact endpoint on
 demand without a client heartbeat. Retirement is final: neither route may revive a
 retired binding, a closed session or an old generation. Delivery lease refresh does
 not renew participant presence.
 
-On darwin-arm64, Codex LocalDaemon and Claude Code Channel have captured
-experimental live delivery. Other adapters retain their separately certified
-next-turn paths or inbox polling. Linux and other uncaptured platforms retain
-the durable inbox; these captures establish no new hook capabilities there.
+Codex LocalDaemon, the Claude Code inbox wake and the Antigravity CLI relay have captured
+experimental live delivery, on darwin-arm64. Those captures set the minimum that applies on
+every platform; on a host they never named, the probe and the per-session handshake decide,
+and a transport that does not answer keeps the durable inbox. Other adapters retain their
+separately certified next-turn paths or inbox polling.
 
 Codex's 120-second delivery lease can refresh on demand for the same live endpoint;
 it does not extend the 24-hour participant presence limit. A TUI exit can leave its
@@ -113,15 +126,15 @@ policy:
 | `all` | every addressed message kind may use live push |
 
 The default is `off`. `acc install --delivery actionable|all` records recipient consent.
-Current activation remains off when the platform, captured minimum or feature probe
-does not qualify; that temporary failure does not erase the requested policy. Each
-session must pass its own generation-bound handshake. An adapter using the installation
-record rereads consent at hooks and before offers, so a long-running vendor process
-cannot retain permission through an old environment value or binding snapshot.
-
-For an adapter using recorded consent, `--delivery off` and uninstall prevent new
-native offers. They cannot withdraw a submission already accepted by the vendor queue. Ordinary hook capabilities still
-require exact-version certification. Room messages are never live-push candidates.
+Current activation remains off when the captured minimum or the feature probe does not
+qualify; that temporary failure does not erase the requested policy. Each
+session must pass its own generation-bound handshake. Every adapter reads consent from the
+installation record and rereads it at hooks and before offers, so a long-running vendor
+process cannot retain permission through an old binding snapshot.
+
+`--delivery off` and uninstall prevent new native offers. They cannot withdraw a submission
+already accepted by the vendor queue. Ordinary hook capabilities still require exact-version
+certification. Room messages are never live-push candidates.
 
 ## Fallback
 

package/docs/CLI.md

@@ -102,7 +102,16 @@ the messages addressed to that participant that it has not fetched, split by how
 got. Two sessions of one participant show the same numbers, so read the workspace total from
 `counts.unretrieved` rather than adding rows, and the text line ends with
 `<n> offered, not retrieved` when that number is above zero. Offered is not read: a
-transport took the bytes, and the model may or may not have looked. Default `sync` reads
+transport took the bytes, and the model may or may not have looked.
+
+A participant with no open session is left out, unless messages still wait for it: queued,
+or offered by a live transport and not yet shown again, so that its next turn would show
+them. A message the next-turn hook already showed does not wait, since nothing will reach the
+participant for it again. A waiting participant's latest session stays listed as `offline`,
+with that number as `waiting`, and with `endReason` when the client said why the session
+ended, such as `"clear"` for Claude Code's `/clear`. The text line names each one:
+`waiting for a closed session: claude_code-b (cleared, 2)`. `acc status --all` lists every
+session. Default `sync` reads
 events after a 16-digit event cursor (100 by
 default, up to 500). `--scope history` discovers historical message headers and reads
 selected records; `--scope full` adds an unbounded snapshot for explicit workspace forensics.
@@ -208,6 +217,36 @@ Human output starts with `recorded message_x`. A transport failure after that co
 not change the command exit code. Reuse an explicit `--client-message-id` after an
 uncertain result to recover the same logical message.
 
+A queued result names why no live offer was made. `no_live_transport` means the recipient
+is online but its session has no live transport bound: a participant attached with the CLI,
+or a client without live delivery. It reads the message from its inbox or next turn, and
+human output says `models has no live transport; the message waits in its inbox`.
+`recipient_offline` means the recipient has no open session; the message waits until one
+starts or resumes. When the client said why its last session ended, the result carries it,
+for example `"endReason": "clear"` after Claude Code's `/clear`, and human output says
+`models's conversation was cleared (/clear); the message waits until that conversation
+resumes`. `recipient_unavailable` means the recipient's session is open but its live
+transport could not be reached.
+
+The delivery outcome `woken` means ACC woke a Claude Code session through its inbox:
+
+```json
+{ "recipientParticipantId": "models", "outcome": "woken", "transport": "claude-inbox" }
+```
+
+Human output prints it as `woke models via claude-inbox; the message arrives with its next turn`.
+The wake carries only fixed ACC text and the message id. The receipt stays `queued`. The
+session's next-turn hook then shows the body and records the receipt as `offered` via
+`next-turn`.
+
+A Claude Code session that bypasses permission prompts holds each wake for its user's
+approval, unless its `crossSessionInbound` setting is `accept`. The outcome then carries
+`"pendingApproval": true`, and human output says
+`sent a wake to models via claude-inbox, which its session holds for approval because it
+bypasses permission prompts; the message arrives with its next turn`. A session whose
+`crossSessionInbound` is `refuse` gets no wake: the message stays `queued` with
+`delivery_disabled`.
+
 `reply` additionally returns `receipt`: the original message id, the replying participant,
 and state `acknowledged`. Its `message` and `delivery` describe the outgoing answer.
 Human output distinguishes `recorded <reply-id>` from `acknowledged <original-id>`.
@@ -320,12 +359,12 @@ terminal asks one default-No question for all selected clients that need a decis
 its local service is unavailable or has no loaded session; this does not activate delivery.
 A non-interactive run or a `--dry-run` keeps fresh clients off. A recorded opt-in is kept on upgrade. If the detected
 client cannot receive native delivery - unsupported, below the captured minimum, a
-prerelease, known-bad, a wrong platform, or an unsupported shell - installation keeps the
-effective policy off and prints the reason. Claude Code shell activation writes an owned
-zsh PATH block and a shim that `exec`s the real client; `ACC_BYPASS=1` bypasses that
-activation. Codex LocalDaemon delivery uses recorded installation consent without changing
-ordinary launch arguments. Its opt-in remains active when shim variables are absent or
-bypassed; `acc install --adapter codex --delivery off` disables new native offers. On a
+prerelease, known-bad, or a wrong platform - installation keeps the
+effective policy off and prints the reason. Every adapter reads live-delivery consent from
+the installation record. Claude Code live delivery uses the inbox that each Claude Code
+session opens itself. ACC adds no launch argument, shell file or wrapper for it. Codex
+LocalDaemon delivery also keeps ordinary launch arguments unchanged.
+`acc install --adapter <adapter> --delivery off` disables new native offers for that client. On a
 supported explicit install, complete consent can prepare a missing Codex service. On macOS
 arm64 with Codex 0.154.0 or newer, the same choice includes downloading a missing standalone
 package from OpenAI. ACC selects the installed CLI version and verifies the official
@@ -341,15 +380,14 @@ The install summary names each client's requested policy,
 activation state and verified fallback. `doctor` separates protocol readiness, recorded
 consent and a live channel in the current workspace, with a next step for missing activation.
 A supported version or an installed plugin alone is not an active delivery channel.
-`runtime: active` means ACC has a reachable local transport binding. Claude can still
-block inbound Channels messages while its MCP server and tools remain connected;
-doctor therefore also names the client-side startup check.
+`runtime: active` means ACC has a reachable local transport binding. Claude Code applies
+its own inbound controls to each wake: a session in `bypassPermissions` mode holds the wake
+for approval. See [delivery troubleshooting](TROUBLESHOOTING.md#a-claude-code-session-holds-or-drops-acc-wakes).
 In doctor JSON, `nativeDelivery.activation` distinguishes missing launch setup from a
 recorded setup (or `not_required` for a pre-existing service). `policy` is the installed
 choice. `deliveryDecision` gives its known source and reports legacy provenance as unknown.
-`nativeServiceSetup` reports service infrastructure separately. `sessionPolicy` describes a native binding when one is visible. Existing Claude
-sessions can retain their launch policy after a different choice is installed for new
-sessions; Codex checks current recorded consent before new offers.
+`nativeServiceSetup` reports service infrastructure separately. `sessionPolicy` describes a native binding when one is visible.
+Every adapter rereads the current recorded consent at hooks and before new offers.
 `nativeDelivery.sessions` lists each current session's identity, present transport state
 and `lastAttempt`: timestamp, startup/turn event, effective policy and its source, whether
 that policy was missing/invalid/off, whether a client process was identified, and the closed

package/docs/CONCEPTS.md

@@ -131,10 +131,11 @@ on a client that takes next-turn bodies.
 ## Durable first, faster delivery second
 
 The durable inbox is universal. An adapter whose captures reach the installed client may
-also offer messages at the next normal turn. Codex LocalDaemon and Claude Code Channel add
-experimental live delivery, off by default and subject to recipient policy and
-current reachability. Codex can retain an eligible daemon thread after its terminal
-exits. [Capabilities](CAPABILITIES.md) gives the current limits.
+also offer messages at the next normal turn. Codex LocalDaemon and the Claude Code inbox
+wake add experimental live delivery, off by default and subject to recipient policy and
+current reachability. A Claude Code wake makes the session run a turn, and that turn's
+next-turn hook shows the message. Codex can retain an eligible daemon thread after its
+terminal exits. [Capabilities](CAPABILITIES.md) gives the current limits.
 
 ## Handoffs preserve explicit context
 

package/docs/CONFIGURATION.md

@@ -129,13 +129,22 @@ acc install --adapter codex --delivery off
 
 The allowed values are `off`, `actionable`, and `all`; the default is `off`. This setting
 does not belong in `acc.workspace.json`, where a pull request could opt someone else into
-spending a turn. It also cannot create a capability. Exact-version evidence governs
-ordinary hook features; Claude Code live delivery separately requires macOS arm64, version
-2.1.258 or newer, and a current feature probe before installation applies the requested
+spending a turn. It also cannot create a capability. Every adapter reads live-delivery
+consent from this installation record, and only from it. Exact-version evidence governs
+ordinary hook features. Claude Code live delivery separately requires macOS arm64, version
+2.1.282 or newer, and a current feature probe before installation applies the requested
 policy. If those install-time checks fail, effective policy remains `off` and the installer
 reports next-turn or inbox fallback. Each later session must also pass its own
 generation-bound handshake. A failed session handshake clears or refuses that binding and
-reports degraded reachability; it does not rewrite the installed consent.
+reports degraded reachability. It does not rewrite the installed consent.
+
+Claude Code live delivery wakes the session through the inbox socket that the session opens
+itself. ACC changes no launch argument, shell profile or `PATH` entry for it. Claude Code's
+own inbound controls still apply to each wake. A session in `bypassPermissions` mode holds
+each wake for your approval unless its `crossSessionInbound` setting is `accept`. A
+`crossSessionInbound` setting of `refuse` drops wakes. These controls belong to you, and ACC
+never overrides them. See
+[held or dropped wakes](TROUBLESHOOTING.md#a-claude-code-session-holds-or-drops-acc-wakes).
 
 Codex LocalDaemon delivery separately requires macOS arm64, Codex 0.152.1 or newer, a
 current feature probe, and exact thread, canonical cwd, process, version and protocol
@@ -144,10 +153,9 @@ standalone package and prepare a definitely absent service. The setup choice nam
 download. Existing service-start consent alone does not permit it. Codex files remain
 under the selected `CODEX_HOME`; the existing CLI command and shell profiles are preserved.
 Message delivery does not install Codex, start it, or stop it.
-Explicit update maintenance can restart a verified service after separate confirmation. Codex reads
-consent from the installation record, not a shell-shim variable. Unavailable or ineligible
-sessions retain durable inbox fallback. Use `acc install --adapter codex --delivery off`
-to stop new native offers; bypassing a shim does not disable that recorded opt-in.
+Explicit update maintenance can restart a verified service after separate confirmation.
+Unavailable or ineligible sessions retain durable inbox fallback. Use
+`acc install --adapter codex --delivery off` to stop new native offers.
 
 ### Codex outgoing permissions
 
@@ -195,7 +203,6 @@ that resolves inside a workspace.
 | `ACC_NO_UPDATE_CHECK=1` | Disables update networking and background scheduling; manual recovery of an already downloaded update remains available |
 | `ACC_PROBE_TIMEOUT_MS` | How long to wait for a client to print its version. Three seconds by default: generous on an idle machine, and not always enough on a busy one, where a client that overruns it is reported as not installed |
 | `ACC_ANTIGRAVITY_HOOKS` | Where `acc install` registers Antigravity CLI hooks. `global`, the default, writes `~/.gemini/config/hooks.json`, which always loads and applies to every Antigravity session on the machine. `workspace` writes `<project>/.agents/hooks.json`, which is scoped to the project the command ran in and loads only while that project is an open Antigravity workspace - in print mode, only when it is passed with `--add-dir`. Any other value is refused by name rather than replaced by the default, and that client is skipped. The two cannot be combined: both files use the namespace `acc`, and a name in both is kept only once |
-| `ACC_NATIVE_DELIVERY_POLICY` | Owned shell-bootstrap consent, currently used by Claude Code. The shim sets `off`, `actionable`, or `all`; missing/invalid values mean off for that route. Codex instead reads recorded installation consent, even when this variable is absent |
-| `ACC_BYPASS=1` | Bypasses owned shell activation, currently Claude Code: no bootstrap check/native flags, and shim policy is unset. It does not disable Codex recorded opt-in; use `acc install --adapter codex --delivery off` for new Codex offers |
-| `ACC_BOOTSTRAP_DEBUG=1` | Lets the internal `acc-bootstrap` check write one safe diagnostic line to stderr. Off, it is silent, and it never writes to stdout |
 | `CODEX_HOME` | Codex's own home, honoured when locating the Codex App Server daemon's control socket for native delivery. Codex sets it; ACC only reads it |
+| `CLAUDE_CONFIG_DIR` | Claude Code's own configuration directory, `~/.claude` by default. ACC reads the session registry `sessions/<pid>.json` under it to verify a session's inbox. ACC reads the value from the hook environment and never sets it |
+| `CLAUDE_CODE_MESSAGING_SOCKET` | The inbox socket of one Claude Code session, which Claude Code exports to that session's hooks. ACC reads it in the hook environment and checks it against the session registry. ACC never reads `CLAUDE_CODE_MESSAGING_TOKEN` |

package/docs/GETTING_STARTED.md

@@ -66,13 +66,14 @@ means the infrastructure is ready. Start a Codex session and complete the client
 trust review to establish a session-bound channel. An incomplete existing standalone
 installation or unsupported CLI version still needs the vendor action named by install.
 
-If you opt into Claude Code's experimental idle delivery, check Claude's Channels startup
-notice for ACC and accept its development-channel warning when shown. If it reports Channels
-unavailable or blocked, a connected MCP server does not make inbound delivery work;
-see [troubleshooting](TROUBLESHOOTING.md#i-enabled-live-delivery-but-got-fallback).
-The feature is off by default, can spend
-model tokens, and currently requires Apple Silicon macOS, zsh, and Claude Code 2.1.258 or
-newer. You do not need it for durable messages or supported next-turn delivery.
+Claude Code's experimental live delivery wakes the session through the inbox that Claude
+Code opens for every session. After you opt in, start Claude Code with your ordinary command.
+ACC adds no launch flag, shell change or wrapper. A session in `bypassPermissions` mode asks
+you to approve each ACC wake. See
+[held or dropped wakes](TROUBLESHOOTING.md#a-claude-code-session-holds-or-drops-acc-wakes).
+The feature is off by default, can spend model tokens, and currently requires Apple Silicon
+macOS and Claude Code 2.1.282 or newer. You do not need it for durable messages or supported
+next-turn delivery.
 
 ## 2. Open two sessions and give them ordinary tasks
 
@@ -140,11 +141,13 @@ Antigravity CLI carries one extra condition: its hooks are given a project direc
 when the session has an open workspace. A session started without one attaches nothing, and
 the client shows no hook output to say so - `acc doctor` names it.
 
-Codex LocalDaemon and Claude Code Channel offer optional native delivery on
-Apple Silicon macOS. They are experimental, can spend tokens, and queue messages
-until a running turn finishes. Codex requires 0.152.1 or newer, LocalDaemon infrastructure,
-recorded opt-in, and a verified session. Supported explicit setup can prepare a missing
-service. Start the client with your normal command. A loaded daemon thread can receive
+Codex LocalDaemon and the Claude Code inbox wake offer optional native delivery on
+Apple Silicon macOS. They are experimental and can spend tokens. Codex queues a message
+until a running turn finishes. A busy Claude Code session takes the wake between two tool
+calls. Claude Code requires 2.1.282 or newer and recorded opt-in, and it wakes through the
+inbox that each session opens itself. Codex requires 0.152.1 or newer, LocalDaemon
+infrastructure, recorded opt-in, and a verified session. Supported explicit setup can
+prepare a missing service. Start the client with your normal command. A loaded daemon thread can receive
 messages after its terminal exits. Antigravity CLI 1.2.7 and later has one too: with delivery enabled,
 ACC's context asks the agent to start a relay from its own shell, up to three times while
 none is running, and you approve that command at the client's prompt.

package/docs/GLOSSARY.md

@@ -16,7 +16,8 @@
 - **Retrieved** — the participant received the body; not proof of model attention.
 - **Acknowledged** — that participant explicitly acknowledged or replied; a reply is not proof requested work finished.
 - **Next-turn delivery** — certified projection at the client's next normal turn; it never interrupts an active turn.
-- **Live push** — optional delivery through Claude Code Channel or Codex LocalDaemon to an already-running session, behind recipient opt-in. Both wait for an active turn to finish; [Capabilities](CAPABILITIES.md) gives the measured eligibility and limits.
+- **Live push** — optional delivery through the Claude Code inbox wake or Codex LocalDaemon to an already-running session, behind recipient opt-in. A busy Claude Code session takes the wake between two tool calls. Codex waits for an active turn to finish. [Capabilities](CAPABILITIES.md) gives the measured eligibility and limits.
+- **Wake** — a live offer that carries only fixed ACC text and the message id. Its delivery outcome is `woken`, and the receipt stays `queued` until the next-turn hook shows the body.
 - **Recipient policy** — `off`, `actionable`, or `all`; opt-in permission to spend a turn, not a capability.
 - **Delivery binding** — ephemeral, generation-bound reachability data owned by an adapter.
 - **Fallback** — durable inbox or certified next-turn recovery when live delivery is unavailable.

package/docs/HOW_IT_WORKS.md

@@ -102,10 +102,14 @@ All recipients have the same durable record, but adapters expose different accel
 - **Next normal turn:** exact captured versions of Codex, Claude Code, Gemini CLI, Antigravity CLI and Kimi
   Code can receive complete attributed peer context when the user next prompts that client.
   This does not wake an idle session.
-- **Optional Claude Code channel:** supported Claude Code versions on Apple Silicon macOS
-  may receive an addressed actionable message while idle. This is experimental, off by
-  default, can spend tokens, never interrupts a running turn, and requires the vendor's
-  visible development-channel warning.
+- **Optional Claude Code inbox wake:** on Apple Silicon macOS with Claude Code 2.1.282 or
+  later, ACC wakes the session through the inbox socket that the session opens itself. The
+  wake is one line of fixed ACC text with the message id. It carries no subject, body or
+  sender name. An idle session starts a turn. A busy session takes the wake between two tool
+  calls and keeps its turn. Each delivered wake fires `UserPromptSubmit`, ACC's next-turn
+  hook, which shows the message in its untrusted block. The model answers with
+  `acc reply`. This is experimental, off by default and can spend tokens. Claude Code's
+  own inbound controls apply to each wake.
 
 - **Optional Codex LocalDaemon delivery:** on Apple Silicon macOS, a captured
   minimum of 0.152.1 plus a current probe and exact session checks allow delivery

package/docs/PROTOCOL.md

@@ -199,6 +199,24 @@ peer body into diagnostics.
 Receipt `offered` is committed only after the transport accepts bytes. A failed attempt
 leaves the receipt queued.
 
+A wake is the one accepted offer that records nothing. An adapter whose native contract
+declares `offerKind: "wake"` sends only a notice that makes the client run a turn. The
+Claude Code inbox wake is one line of fixed ACC text with the message id, and it carries no
+subject, body, sender name or other peer byte. The router records no event for an accepted
+wake and returns this delivery outcome:
+
+```json
+{ "recipientParticipantId": "<id>", "outcome": "woken", "transport": "claude-inbox" }
+```
+
+An adapter whose client took the wake but holds it for its user's approval adds
+`"pendingApproval": true` to its acceptance, and the outcome carries it. Nothing about it is
+stored.
+
+The receipt stays `queued`. The recipient's next-turn hook shows the body and records
+`message.offer_succeeded` with `transport: "next-turn"` after its output carried the body.
+A failed wake is recorded as `message.offer_failed`, like any failed offer.
+
 The same transaction records how the receipt was offered, in the receipt's `extensions`:
 
 ```json
@@ -298,12 +316,13 @@ The recipient owns `livePolicy` because native push may start a model turn:
 
 Default is `off`. Policy never creates a capability. The router requires one
 current eligible recipient generation, supported client evidence, a verified
-binding and adapter acceptance. Claude Code Channel uses a captured 2.1.258
-minimum, confirmed on 2.1.260. Codex LocalDaemon uses a 0.152.1 minimum, confirmed
-through installed-product captures on 0.152.1 and 0.153.4; recorded consent and
-exact thread, cwd, process, version and protocol verification govern every session.
-Unavailable or refused routes fall back durably. Codex replies use the ACC CLI;
-its native reply route remains false.
+binding and adapter acceptance. The Claude Code inbox wake uses a 2.1.282 minimum,
+captured on darwin-arm64 and applied on every platform. Its binding requires the same pid and socket in Claude Code's
+session registry, and every refresh and wake also requires the same session id. Codex LocalDaemon uses a 0.152.1 minimum, confirmed
+through installed-product captures on 0.152.1 and 0.153.4. Recorded consent and
+exact thread, cwd, process, version and protocol verification govern every Codex session.
+Unavailable or refused routes fall back durably. Claude Code and Codex replies use the ACC
+CLI. Their native reply route remains false.
 
 ## Attention and sync
 

package/docs/RELEASING.md

@@ -1,8 +1,8 @@
 # Releasing
 
 Use this procedure to build one auditable npm artifact, verify that exact tarball, and keep
-its evidence tied to the commit that supplied its bytes. The package is currently `0.5.0`;
-the commands derive the version from `package.json` so the filename cannot drift.
+its evidence tied to the commit that supplied its bytes. The commands derive the version
+from `package.json` so the filename cannot drift.
 
 ```mermaid
 graph LR
@@ -118,9 +118,12 @@ work belongs under `Unreleased` and gets a new candidate record.
 ## Capture only capabilities you observed
 
 Run native real-client checks on the exact versions and platforms recorded in
-retained fixtures. Exact-version evidence governs normal-turn and guard behavior.
-Claude Code Channel uses its captured macOS arm64 minimum plus a current probe and
-per-session handshake; its vendor warning remains part of startup. Codex LocalDaemon
+retained fixtures. A capture records evidence, and it never gates beyond that floor: what it
+proves applies from its version onward and on every platform, and what refuses a client is
+the machine's own probe or handshake, an older client, or a recorded regression.
+The Claude Code inbox wake uses its captured minimum plus a current probe and
+per-session handshake. Its passing capture is a real-client product run of the packed
+candidate, launched with the ordinary command and installed hooks. Codex LocalDaemon
 uses a separate 0.152.1 minimum with installed-product captures on 0.152.1 and
 0.153.4. Its passing capture must ship the hashed complete product matrix and
 historical evidence references. Direct queue success alone cannot certify that route.

package/docs/SECURITY_MODEL.md

@@ -73,13 +73,26 @@ never copy the peer body.
 
 A live adapter must match its declared evidence contract, one current
 generation-bound binding and recipient opt-in. Opaque endpoints remain private
-and outside repositories. Claude Code Channel and Codex LocalDaemon delivery are
+and outside repositories. Claude Code inbox wakes and Codex LocalDaemon delivery are
 experimental and off by default. Codex verifies the exact receiver thread,
 canonical cwd, live process, stable version and protocol, and rereads recorded
 consent before offers. A loaded daemon thread can receive messages after its TUI
 exits. Delivery off and uninstall prevent new Codex submissions; a submission
 already accepted by the vendor queue cannot be withdrawn.
 
+A Claude Code inbox wake carries only fixed ACC text. It is one line with the message id,
+and it carries no subject, body, sender name or other peer byte. The body reaches the model
+only through the next-turn hook, inside the untrusted `acc-peer-message` block. Before each
+wake, ACC checks that the session registry still names the same pid, session id and socket,
+so a wake never reaches a reused pid.
+
+ACC connects to the inbox without credentials. It never reads the session's
+`CLAUDE_CODE_MESSAGING_TOKEN` or its `.key` file, and it sends no auth line. A frame with
+that token would pass as the session's own child and skip the receiver's inbound controls.
+ACC also never attests a permission mode. Claude Code's inbound controls therefore stay the
+user's: a session in `bypassPermissions` mode holds each wake for approval unless
+`crossSessionInbound` is `accept`, and `refuse` drops wakes.
+
 On captured Codex/macOS configurations, live opt-in also grants outgoing access to ACC's
 state and local Unix sockets through a deny-by-default network proxy. Custom permission
 policies remain user-owned. Selection, proxy and grants are restored together only while