session-peer 1.2.1__tar.gz → 1.3.0__tar.gz

{session_peer-1.2.1 → session_peer-1.3.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: session-peer
-Version: 1.2.1
+Version: 1.3.0
 Summary: Discover and message Claude Code, Codex, and Antigravity sessions locally, over SSH, through MCP, or via an optional end-to-end encrypted relay.
 Project-URL: Homepage, https://github.com/abruption/session-peer
 Project-URL: Repository, https://github.com/abruption/session-peer
@@ -68,11 +68,11 @@ in this ~22-second animation, not a screen recording; send success alone is not
 ### Install
 
 Python 3.9+. The core local/SSH CLI has no third-party Python dependencies.
-Source version: **1.2.1**. At the 2026-10-19 publication checkpoint, the last verified published stable release was **1.2.0**.
+Source version: **1.3.0**. At the 2026-10-23 preparation checkpoint, the last verified published stable release was **1.2.1**.
 
-See the [publication record and historical preparation](docs/releases/v1.2.0.md) for published version 1.2.0. Package publication and operational deployment are separate.
+Version 1.3.0 adds delivery explanations, local/SSH route presets and recipient addresses, bounded handoff observation, trusted SSH configuration, pairing links and per-version notice preferences. See the [release scope and verification gates](docs/releases/v1.3.0.md) for supported combinations and limits. Package publication and operational deployment are separate.
 
-Check [GitHub Releases](https://github.com/abruption/session-peer/releases) and [PyPI](https://pypi.org/project/session-peer/) for available versions. The [preparation notes](docs/releases/v1.2.1.md) record the dated patch scope and remaining gates; a source version alone does not establish package availability.
+Check [GitHub Releases](https://github.com/abruption/session-peer/releases) and [PyPI](https://pypi.org/project/session-peer/) for available versions; a source version alone does not establish package availability.
 
 Experimental handoff is opt-in: local POSIX Claude supports receipt ACKs; Codex and SSH support correlation-only submission, not ACK observation. See the [handoff guide](docs/handoff-runtime.md) for the shipped scope and remaining acceptance gates.
 

{session_peer-1.2.1 → session_peer-1.3.0}/README.ja.md

@@ -34,11 +34,11 @@ session-peer 1.0.2による実際のローカル通信です。CodexがClaude Co
 ### インストール
 
 Python 3.9以上が必要です。基本のローカル・SSH CLIに外部Python依存パッケージはありません。
-ソースバージョン：**1.2.1**。2026-10-19の公開状況の確認時点で、最後に確認した公開済み安定版は**1.2.0**でした。
+ソースバージョン：**1.3.0**。2026-10-23の準備時点で、最後に確認した公開済み安定版は**1.2.1**でした。
 
-公開済み1.2.0の[公開記録・過去の準備](docs/ja/releases/v1.2.0.md)を参照してください。パッケージ公開と本番環境への配備は別です。
+1.3.0では配信説明、ローカル・SSH経路プリセットと受信者アドレス帳、時間制限付きhandoff観察、信頼したSSH設定、ペアリングリンク、バージョン別通知設定を追加します。対応する組み合わせと制限は[リリース範囲と検証条件](docs/ja/releases/v1.3.0.md)を参照してください。パッケージ公開と本番環境への配備は別です。
 
-入手できるバージョンは[GitHub Releases](https://github.com/abruption/session-peer/releases)と[PyPI](https://pypi.org/project/session-peer/)で確認してください。[準備記録](docs/ja/releases/v1.2.1.md)は記載日時点のパッチ範囲と残る条件を説明します。ソースのバージョンだけではパッケージの公開状況は確認できません。
+入手できるバージョンは[GitHub Releases](https://github.com/abruption/session-peer/releases)と[PyPI](https://pypi.org/project/session-peer/)で確認してください。ソースのバージョンだけではパッケージの公開状況は確認できません。
 
 実験的なhandoffは明示的に選択する機能です。ローカルPOSIX Claudeは受領ACKに対応し、CodexとSSHは相関IDによる送信のみ対応してACKの観察には対応しません。公開済みの範囲と残る検証条件は[handoffガイド](docs/ja/handoff-runtime.md)を参照してください。
 

{session_peer-1.2.1 → session_peer-1.3.0}/README.ko.md

@@ -34,11 +34,11 @@ session-peer 1.0.2를 사용해 실제 로컬 요청과 회신을 주고받았
 ### 설치
 
 Python 3.9 이상이 필요합니다. 기본 로컬·SSH CLI는 외부 Python 패키지에 의존하지 않습니다.
-소스 버전: **1.2.1**. 2026-10-19 공개 상태 확인 시점의 마지막 확인 공개 안정판은 **1.2.0**이었습니다.
+소스 버전: **1.3.0**. 2026-10-23 준비 시점의 마지막 확인 공개 안정판은 **1.2.1**이었습니다.
 
-공개 버전 1.2.0의 [공개 증거 및 과거 준비 기록](docs/ko/releases/v1.2.0.md)을 참고하십시오. 패키지 공개와 운영 배포는 별개입니다.
+1.3.0에는 전달 설명, 로컬·SSH 경로 프리셋과 수신자 주소록, 유한 시간 handoff 관찰, 신뢰한 SSH 설정, 페어링 링크와 버전별 알림 설정이 추가됩니다. 지원 조합과 제한은 [릴리스 범위와 검증 조건](docs/ko/releases/v1.3.0.md)을 참고하십시오. 패키지 공개와 운영 배포는 별개입니다.
 
-설치할 수 있는 버전은 [GitHub Releases](https://github.com/abruption/session-peer/releases)와 [PyPI](https://pypi.org/project/session-peer/)에서 확인하십시오. [준비 기록](docs/ko/releases/v1.2.1.md)은 해당 날짜의 패치 범위와 남은 조건을 설명하며, 소스 버전만으로 패키지 공개 여부가 확인되는 것은 아닙니다.
+설치할 수 있는 버전은 [GitHub Releases](https://github.com/abruption/session-peer/releases)와 [PyPI](https://pypi.org/project/session-peer/)에서 확인하십시오. 소스 버전만으로 패키지 공개 여부가 확인되는 것은 아닙니다.
 
 실험적 handoff는 명시적으로 선택해야 합니다. 로컬 POSIX Claude는 영수증 ACK를 지원하지만, Codex와 SSH는 상관 ID를 이용한 제출만 지원하며 ACK 관찰은 지원하지 않습니다. 공개된 범위와 남은 검증 조건은 [handoff 가이드](docs/ko/handoff-runtime.md)를 참고하십시오.
 

{session_peer-1.2.1 → session_peer-1.3.0}/README.md

@@ -34,11 +34,11 @@ in this ~22-second animation, not a screen recording; send success alone is not
 ### Install
 
 Python 3.9+. The core local/SSH CLI has no third-party Python dependencies.
-Source version: **1.2.1**. At the 2026-10-19 publication checkpoint, the last verified published stable release was **1.2.0**.
+Source version: **1.3.0**. At the 2026-10-23 preparation checkpoint, the last verified published stable release was **1.2.1**.
 
-See the [publication record and historical preparation](docs/releases/v1.2.0.md) for published version 1.2.0. Package publication and operational deployment are separate.
+Version 1.3.0 adds delivery explanations, local/SSH route presets and recipient addresses, bounded handoff observation, trusted SSH configuration, pairing links and per-version notice preferences. See the [release scope and verification gates](docs/releases/v1.3.0.md) for supported combinations and limits. Package publication and operational deployment are separate.
 
-Check [GitHub Releases](https://github.com/abruption/session-peer/releases) and [PyPI](https://pypi.org/project/session-peer/) for available versions. The [preparation notes](docs/releases/v1.2.1.md) record the dated patch scope and remaining gates; a source version alone does not establish package availability.
+Check [GitHub Releases](https://github.com/abruption/session-peer/releases) and [PyPI](https://pypi.org/project/session-peer/) for available versions; a source version alone does not establish package availability.
 
 Experimental handoff is opt-in: local POSIX Claude supports receipt ACKs; Codex and SSH support correlation-only submission, not ACK observation. See the [handoff guide](docs/handoff-runtime.md) for the shipped scope and remaining acceptance gates.
 

{session_peer-1.2.1 → session_peer-1.3.0}/README.zh-CN.md

@@ -34,11 +34,11 @@ session-peer使用各智能体自身的收件箱和队列；接收方智能体
 ### 安装
 
 需要Python 3.9或更高版本。核心本地与SSH CLI没有第三方Python依赖。
-源码版本：**1.2.1**。在2026-10-19的发布状态检查时，最后确认的已发布稳定版本为**1.2.0**。
+源码版本：**1.3.0**。在2026-10-23的准备检查时，最后确认的已发布稳定版本为**1.2.1**。
 
-已发布的1.2.0请参阅[发布记录与历史准备](docs/zh-CN/releases/v1.2.0.md)。软件包发布与生产环境部署是两项独立操作。
+1.3.0增加传递说明、本地与SSH路由预设及收件人地址簿、有时限的handoff观察、受信任SSH配置、配对链接和按版本设置的通知偏好。支持的组合与限制请参阅[发布范围与验证条件](docs/zh-CN/releases/v1.3.0.md)。软件包发布与生产环境部署是两项独立操作。
 
-可用版本请查看[GitHub Releases](https://github.com/abruption/session-peer/releases)和[PyPI](https://pypi.org/project/session-peer/)。[准备记录](docs/zh-CN/releases/v1.2.1.md)说明记录日期时的补丁范围与剩余门禁；仅凭源码版本不能确认软件包是否已发布。
+可用版本请查看[GitHub Releases](https://github.com/abruption/session-peer/releases)和[PyPI](https://pypi.org/project/session-peer/)。仅凭源码版本不能确认软件包是否已发布。
 
 实验性handoff需要明确选择启用：本地POSIX Claude支持收据ACK；Codex与SSH仅支持关联标识提交，不支持ACK观察。已发布范围与剩余验收条件请参阅[handoff指南](docs/zh-CN/handoff-runtime.md)。
 

{session_peer-1.2.1 → session_peer-1.3.0}/docs/README.md

@@ -24,6 +24,8 @@ installation paths.
 
 ## Development and history
 
+- [v1.3.0 release notes](releases/v1.3.0.md) describe the six merged features, supported combinations and release verification.
+
 - [v1.2.1 preparation notes](releases/v1.2.1.md) record the 2026-10-19 patch candidate for Orca Claude discovery, skill metadata reading and the compatibility skill copy; publication remains separate.
 
 - [v1.2.0 published record and historical preparation](releases/v1.2.0.md) record the 2026-10-16 publication separately from preparation started on 2026-10-15 and updated on 2026-10-16, the merged six-PR scope and remaining acceptance gates.

{session_peer-1.2.1 → session_peer-1.3.0}/docs/cli-reference.md

@@ -60,6 +60,31 @@ not a `--agent` flag.
 running. Plain send does not activate a session; [explicit `--wake`](wake.md)
 is opt-in and does not confirm consumption or a reply.
 
+<a id="delivery-explanation"></a>
+
+<a id="delivery-explanation-development"></a>
+
+### Delivery explanation (v1.3.0)
+
+Available in v1.3.0. Add `--explain` to `send --dry-run` for a human-readable summary of the selected local, SSH or paired-device destination, existing validation result, delivery method and observation limits. `doctor --explain` describes the existing diagnostic snapshot and declared capabilities, not per-target readiness. `handoff status --explain` describes an existing intent's stored evidence. Each processed SSH destination receives its own summary; an unexpected error can still stop the existing host loop before later destinations are processed.
+
+```bash
+session-peer send --host worker --to 'codex:<full-thread-uuid>' --message "Review the patch" --dry-run --explain
+session-peer send --device RECEIVER_FINGERPRINT --to review --message "Review the patch" --dry-run --explain
+session-peer doctor --explain
+session-peer handoff status --correlation-id PREPARED_UUID --explain
+```
+
+The explanation reuses the selected command's existing results and adds no diagnostic, native-version or SSH probes, target activation or standalone `list` work. The dry-run itself may already run version checks. A later send repeats validation; a successful preview does not reserve the destination or guarantee submission, consumption or completion. Declared support, observed checks and unknown facts are shown separately. Without `--wake`, wake eligibility is not checked. With it, only the existing preflight result is described.
+
+Paired dry-run keeps the existing receiver-policy `resolve` operation. The existing connection probe negotiates optional explanation context only with a receiver advertising support. This internal context is versioned, allowlisted and limited to 8 KiB; it adds no general JSON output or handoff schema. The selected receiver agent, target and home are shown only when reported and validated, never guessed from the sender's profile. Older receivers retain their independently known native results while unreported context stays unknown; no fallback, extra probe or resend is attempted.
+
+Handoff status reuses its read-only snapshot without creating an intent, receipt capability, wait or collector, or writing the ledger. Submission, injection observation, explicit receipt and latest stored wait remain separate; even an acknowledged receipt does not prove task completion. Stored observations may be stale. Only a reported receipt observation time is described as such; a description's generation time or diagnostic snapshot is not a delivery observation time. Ordinary sends do not gain receipt ACK support.
+
+This scope is text-only: combining `--explain` with `--json` or `--output-format json` is a usage error. Only `send --explain` requires `--dry-run`; `doctor --explain` and `handoff status --explain` do not. Send still refuses experimental handoff `--correlation-id`, `--request-ack`, `--observe-delivery` and `--wait-for` with `--explain`, before message input or destination/ledger work. Existing commands without the new option keep their output, JSON and exit contracts; explanation does not turn a successful status query into proof of ACK or change the underlying command's exit meaning.
+
+For send, the normal message requirement and limits still apply: supply `--message`, `--message-file` or stdin as usual; no placeholder body is generated. Explanation fields do not include the body or receipt secrets. Normal explanations use stdout; failed results or unexpected submission evidence use stderr, without moving existing summary/error output. Unknown evidence stays unknown, and an uncertain actual send must never trigger automatic resend.
+
 ### Optional paired devices and Antigravity (v0.9)
 
 These features are available starting with PyPI v0.9.0. Antigravity remains
@@ -147,6 +172,73 @@ are ordinary command errors (JSON when requested, exit 1). No messages are
 submitted in either case. JSON results still describe submission rather than
 receipt; these flags introduce no structured JSON message-input protocol.
 
+<a id="route-presets"></a>
+
+<a id="local-route-presets-development"></a>
+
+## Local route presets (v1.3.0)
+
+Available in v1.3.0. The opt-in `preset` commands remember routes, not recipients. Use `--preset` to select one saved local or SSH route for ordinary Claude Code or Codex listing/sending on Mac/Linux. Windows preset operations are refused; ordinary Windows commands remain unchanged.
+
+```bash
+session-peer preset add work-mac --host user@work-mac --agent codex --codex-home /Users/user/.codex
+session-peer preset list
+session-peer preset show work-mac --json
+session-peer list --preset work-mac
+session-peer send --preset work-mac --to 'codex:<full-thread-uuid>' --message "Review the patch" --dry-run
+session-peer send --preset work-mac --preset-revision 'dp1:<HASH>' --to 'codex:<full-thread-uuid>' --message "Review the patch"
+session-peer preset replace work-mac --expect-revision 'dp1:<HASH>' --host user@new-mac --agent codex --codex-home /Users/user/.codex
+session-peer preset remove work-mac --expect-revision 'dp1:<CURRENT-HASH>'
+```
+
+Replace the UUID with a current discovery result and the hash with the exact revision printed by the selected preset. A real send requires `--preset-revision`; a dry run may omit it. The `dp1:` hash covers the preset name and exact validated route values, not DNS, SSH configuration, host keys, native ownership, permission, generation or ACK. Changed route values require a fresh review; restoring identical values yields the same hash. Replacement/removal require `--expect-revision`, and adding an existing name is refused.
+
+Recipient names, PIDs, UUIDs and generation tokens are never saved. `--to` remains mandatory; a name is freshly resolved by existing rules, not bound to an earlier session. Existing explicit `--target-generation`, writer/storage checks and unknown/no-automatic-resend behavior are retained. A preset label does not authenticate a person or prove delivery.
+
+Storage is `$XDG_CONFIG_HOME/session-peer/destinations.json`, or `~/.config/session-peer/destinations.json` when the variable is unset; the configured base must be absolute. The application directory is owner-only 0700 and files are owner-only 0600 or stricter. Symlinks, unsafe ownership/permissions, duplicate/unknown JSON keys, malformed UTF-8, more than 128 entries or more than 64 KiB are refused without falling back to another route. Names match `[a-z][a-z0-9_-]{0,63}`. The schema stores only transport/agent, one SSH host when needed, and an absolute Codex home for Codex routes:
+
+```json
+{"schemaVersion":1,"presets":{"work-mac":{"transport":"ssh","agent":"codex","host":"user@work-mac","codexHome":"/Users/user/.codex"}}}
+```
+
+Combining a preset with explicit `--host`, `--codex-home`, `--agent`, `--ssh-opt` or `--codex-bin` is an error even if the values match; Reply-To URIs, paired devices, Antigravity, wake and experimental handoff combinations are also excluded. No credentials, executable paths, SSH commands/options, approval settings or receipt secrets are stored. Existing operator-owned SSH configuration still applies.
+
+`preset list` and `preset show` read configuration only: no native discovery, SSH, update notices or background refresh; missing storage is not initialized by a read. By contrast, `list --preset` explicitly runs the ordinary discovery for that one route, including any existing remote probes and partial-failure behavior. No other presets are contacted and no group broadcast is added.
+
+Text list/send operations print the chosen route and revision to stderr before the existing action. Existing native result JSON, stdout and exit contracts are unchanged; preset flags, revisions and local file paths are not forwarded over SSH. Each invocation uses one read snapshot. Later replacement/removal does not cancel an already expanded invocation; actual submission still revalidates the native target. This is not atomic storage/owner attestation, receiver deduplication, consumption, ACK or task completion.
+
+A `preset_commit_unconfirmed` error means an atomic replacement may already be visible but its durability could not be confirmed. Inspect the current configuration before retrying; no automatic rollback is attempted.
+
+Checked ancestors must be owned by root or the current user and not writable by others, except a root-owned sticky temporary directory; the immediate configuration parent must belong to the current user. All path components are opened without following symlinks. Extended ACL entries on private storage are conservatively refused; macOS ancestors may contain deny-only ACLs, but allow entries or unverifiable ACLs are refused. Linux POSIX ACLs are also checked. An empty or relative `XDG_CONFIG_HOME` is refused rather than silently selecting another path. Existing permissions are not repaired automatically: choose a safe, private absolute configuration root, or inspect and repair malformed configuration offline after keeping a private backup. Do not publish its contents.
+
+On macOS, mounts that ignore ownership are refused with `preset_ownership_unenforced`; an unavailable or unverifiable mount query is refused with `preset_mount_unverifiable`. Mode bits alone are not treated as proof that ownership is enforced. On Linux, ACLs on ancestors are also refused, as are filesystems whose ACL state cannot be verified. After an interrupted management command, inspect the current configuration because the change may already be visible; directory-sync failures are not silently accepted.
+
+<a id="recipient-addressbook-development"></a>
+
+### Recipient addressbook (v1.3.0)
+
+Available in v1.3.0. A route preset still stores only a route. The separate, opt-in addressbook binds a user-supplied label to an explicitly selected Claude Code or Codex recipient on a local or SSH Mac/Linux route. Labels do not authenticate people. Paired devices, Antigravity and Windows are refused. Commands without an explicit addressbook operation or `--address` do not read addressbook configuration; no automatic migration or fallback is added.
+
+```bash
+session-peer address resolve --preset work-mac --to 'codex:<full-thread-uuid>' --json
+session-peer address add review --label Review --preset work-mac --to 'codex:<full-thread-uuid>' --expect-selection 'as1:<HASH>'
+session-peer address discover --address review --json
+session-peer send --address review --dry-run --message 'Review the patch'
+session-peer send --address review --address-revision 'ab1:<HASH>' --confirm-target 'codex:<full-thread-uuid>' --message 'Review the patch'
+session-peer address reselect review --expect-revision 'ab1:<OLD_HASH>' --to 'codex:<new-full-thread-uuid>' --expect-selection 'as1:<NEW_HASH>'
+session-peer address remove review --expect-revision 'ab1:<HASH>'
+```
+
+Replace placeholders with the exact reported values. Before `add`, inspect `address resolve` and use its `as1:` observation revision. Before `reselect`, resolve the intended new target with the same preset again and review its new `as1:` value. `as1:` is a revision of observed selection metadata, not authority, a native epoch or proof of consumption. Every successful add or reselect creates a new `bindingId`, covered by the `ab1:` address revision. Removing and recreating an identical address therefore cannot reuse the old revision. A route's `dp1:` remains a value hash: restoring identical preset values gives the same hash, not a new epoch.
+
+`address list` and `address show` read configuration only. `address resolve` and `address discover` explicitly inspect selected recipient metadata without a placeholder message, native CLI/version probe or model/session activation; existing OS process-metadata inspection may run. Discover accepts at most 16 distinct `--address` names, grouping only identical route/home and pinned SSH-key contexts so each group is inspected once. It retains per-address partial failures and returns exit 1 if any selection fails or no longer matches. It neither scans the network nor broadcasts to a group. A missing referenced preset or changed route/revision is refused; the stored old route is never used as a fallback.
+
+Claude addresses retain the selected `tg1:` generation and use the existing connected-peer precondition before submission. Codex addresses retain a full thread UUID, exact home and `aw1:` writer observation, with existing checks repeated before the effect. Codex generation remains **unsupported**: writer observation and revalidation are not an atomic native incarnation guarantee. A changed or unavailable writer requires explicit reselection; no automatic retargeting or replay is attempted. SSH selection requires a host key verified on the actual connection and pins that same key for the actual send. This authenticates neither a person nor the identity of SSH configuration or SQLite storage.
+
+An actual send requires both the current `--address-revision` and exact `--confirm-target`; dry-run may omit them. `--address` cannot be combined with `--to`, `--preset`, explicit host/native/SSH overrides, paired-device, wake, handoff or Reply-To URI routing. Normal message inputs and limits remain unchanged. Unknown outcomes never authorize automatic resend. Use `send --address NAME --dry-run --explain` with a normal message input for a text-only delivery preview. `--explain` rejects JSON output; the `--address` wake and handoff restrictions still apply.
+
+Storage is a separate `addresses.json` beside `destinations.json`, with `schemaVersion: 1`, a 64 KiB limit and at most 128 entries. It uses the same owner, permissions, ACL, mount and no-symlink-following checks as presets, without automatically repairing or migrating files. Address names follow the preset-name syntax; display labels are normalized to NFC and limited to 128 characters, rejecting control, bidirectional-control and format characters. An unconfirmed management commit may already be visible: inspect current configuration before retrying. Binding revisions do not add receiver deduplication, ACK or task-completion evidence.
+
 ## Optional interactive shorthand
 
 For releases containing these assets, Bash/zsh and PowerShell users can opt in to a shell-local alias named `sp`. It invokes the currently selected `session-peer` command with the same arguments, stdin, output, exit codes and permissions. It is not a separate parser or a Python/TypeScript selector. Keep the canonical command in scripts, SSH requests and generated reply instructions. Do not install both implementations simultaneously; switch with the original installation manager and verify which command your shell resolves first.
@@ -416,8 +508,126 @@ error, `2` CLI usage error or an unresolved target reported as no-target, and
 is an operational error (`1`); a missing saved thread during dry-run returns `2`.
 Exit `0` on send does not confirm consumption or a reply.
 
+<a id="bounded-handoff-watch-v13-candidate"></a>
+
+### Bounded handoff watch (v1.3.0)
+
+```sh
+session-peer handoff status --correlation-id PREPARED_UUID --json
+session-peer handoff watch --correlation-id PREPARED_UUID --watch-timeout 30 --interval-ms 1000 --json
+```
+
+Use an existing prepared UUID in the local owner's POSIX ledger. Status remains one snapshot; watch polls for 1..60 seconds (default 30) at 1000..5000 millisecond intervals (default 1000), accepting ASCII integers only and taking at most 61 samples. Watch emits an initial snapshot only if the budget permits a valid public projection, then changed public metadata/historyPhase only; it may emit no snapshots. JSON watch output uses the common schemaVersion 1 NDJSON envelope with operation watch and event snapshot or end, nesting the unchanged handoff object in snapshots; status JSON is unchanged. Timeout completion is exit 0 for watch completion only, not ACK or wait success; SIGINT is 130, history/output failure 1, invalid arguments 2. Missing/corrupt history or ledgerEpoch change stops watching. historyPhase is prepared, attempted, terminal, tombstone or quarantined; attempted means a durable attempt fence, not active execution.
+
+Watch is read-only: no intents, waits, receipts, ledger writes, submission or wake. It adds no host/device/Windows route or Codex ACK. Limits are 16 KiB per frame and 256 KiB total with a 2 KiB end reserve. Real-fd stdout uses one owned isolated output-only Python helper that sees only bounded public serialized bytes, never changes shared descriptor flags and reads no ledger/native data. The parent enforces the original total budget including IPC, checks it before new ledger read/validation stages, and reserves 100 ms within it for final output and cleanup, so sampling may end earlier. It terminates and reaps its helper on timeout, SIGINT or error; uninterruptible OS operations prevent a hard-real-time guarantee. Partial or unacknowledged writes prohibit subsequent/end frames; consumers must reject truncated final NDJSON lines. Helper completion means OS write completion, not recipient consumption. Snapshots are not a lossless event stream, and local UTC observations do not prove ACK arrival order. See the [handoff runtime guide](handoff-runtime.md) for privacy, retained submission/ACK/wait meanings, read-only collector queries and the existing quarantine gate. Watch launches no native message process or collector. No payload/capability digests are exposed; public targetGeneration keeps its existing contract. The read-only ledger releases its shared lock after reading immutable snapshot bytes, before parsing and validation. Interrupted final output and cleanup are capped at 100 ms within the remaining total budget. Overall success requires a complete successful end frame and exit 0: cleanup may fail after that frame. A nonzero exit means overall failure, without promoting ACK, discarding independently valid submission facts or permitting retry.
+
+<a id="trusted-local-ssh-configuration-v13-candidate-not-published"></a>
+
+### Trusted local SSH configuration (v1.3.0)
+
+On Linux and macOS, an explicit local CLI invocation of `list`, `send`, `doctor`,
+or `update` with `--host` can select an existing OpenSSH configuration by pairing
+`--ssh-config ABSOLUTE_PATH` with `--trust-ssh-config`. Both flags are required.
+For example, using a placeholder path (quoted spaces are supported):
+
+```bash
+session-peer list --host worker --ssh-config '/home/alice/SSH Profiles/work.conf' --trust-ssh-config
+session-peer doctor --host worker --ssh-config '/home/alice/SSH Profiles/work.conf' --trust-ssh-config --check-return-route
+```
+
+This grants local code-execution authority to the selected configuration:
+`Match exec` can run even during `ssh -G` identity discovery or `send --dry-run`.
+The operator must also trust `Include` files, `ProxyCommand`, and other external
+dependencies. Validation is not a configuration sandbox and does not recursively
+validate those dependencies. No existing profile or configuration file is edited.
+
+The path must be absolute, with no `..` components, control characters, or
+symlinks in any component. The selected file must be a regular file owned by the
+current effective user, have exactly one hard link, be at most 64 KiB, and have
+neither group/other write permissions nor setuid/setgid/sticky bits. Ancestor
+directories must be owned by root or the current effective user and must not be
+group/other writable, except for root-owned sticky directories. Linux rejects
+extended access ACLs and directory default ACLs; macOS rejects allow ACL entries
+and volumes with ownership disabled. ACL or ownership checks that cannot be
+verified refuse the selection. These are conservative checks, not a full
+effective-permissions interpreter.
+
+One selection is reused throughout that CLI call for local `ssh -G` discovery,
+doctor, remote listing/version checks, update probes/install/verification, and
+send/handoff SSH calls. Before each SSH spawn it revalidates file identity,
+metadata, content hash, and storage safety. Detected changes refuse the operation
+without falling back to default configuration. OpenSSH opens the original path;
+this is not an immutable byte snapshot and a same-user change between validation
+and OpenSSH's read remains possible.
+
+This mode forces `StrictHostKeyChecking=yes`, `UpdateHostKeys=no`,
+`ForwardAgent=no`, `PermitLocalCommand=no`, and `BatchMode=yes`, and disables
+connection multiplexing. Existing explicit host-key pins retain priority. The
+`--ssh-opt` allowlist is unchanged: `-F` and `ProxyCommand` remain forbidden there.
+The selected local path is not forwarded to the remote command, reply route, or
+public JSON. Reverse doctor checks use the remote machine's own configuration;
+they never inherit this path. Forward success does not prove reverse
+authentication, message consumption, or an ACK.
+
+Environment variables, MCP requests, ReplyTo addresses, and stored presets cannot
+select this mode. Windows, `setup`, paired-device routes, preset combinations,
+reply-URI destinations, and invocations without `--host` are rejected before
+reading the configuration or starting SSH. Omitting the pair preserves the
+existing default SSH behavior.
+
+<a id="one-time-pairing-links-v13-candidate"></a>
+
+### One-time pairing links (v1.3.0)
+
+Both endpoints need `pairing-offer-v1` and the existing Unix Python 3.11+ relay extra. The following commands are available in v1.3.0:
+
+```sh
+session-peer device rotation-status --state /private/client-state
+session-peer device offer --state /private/device-state --peer-key CLIENT-CURRENT-64-HEX-KEY --direct PRIVATE-IP:3770 --show-link
+session-peer device pair --state /private/client-state --link --route direct
+session-peer device offer-status --state /private/device-state --offer-id OFFER-UUID
+session-peer device offer-cancel --state /private/device-state --offer-id OFFER-UUID
+```
+
+Creation confirms both identities and shows the link only on the owner terminal. `--link` takes no value: input is hidden and bounded; the client independently confirms the receiver's current fingerprint before trust staging or networking. No terminal means refusal, not echo fallback or automatic consent. Never put a link in argv, browser history, logs or issue reports. Guided setup offers link/private-file choices; existing file commands remain supported. Cancellation affects only that offer's pending trust, not completed pairing; use explicit peer revocation after completion. Expired cold links are refused; only exact saved context can reconcile an already-consumed authenticated result. Pairing never replaces the receiving target policy or native approval. See the [paired-device guide](paired-devices.md) for key-rotation restrictions, expiry, quotas, interruption and the threat model.
+
 ### Updating
 
+On macOS/Linux, hide the automatic runtime notice for one explicitly selected
+stable version, or clear that preference:
+
+```bash
+session-peer update --dismiss-runtime-notice 1.3.1
+session-peer update --clear-runtime-notice-dismissal
+```
+
+The version above is an example, not a release announcement. These local-only,
+offline commands do not check, install or approve a release. They cannot be
+combined with remote/SSH options or the check option. Only the exact normalized
+version is hidden; later releases can still produce a notice, and clearing
+restores the usual behavior. Explicit local checks retain the real latest version
+and outdated result, with separate preference metadata. Remote checks, skill
+notices and the existing global opt-out are unchanged. A remote command may still
+show the calling CLI's own cached notice; its local preference is read once, not
+once per target. Remote versions and results are never hidden by that preference.
+
+The preference is stored separately from the update cache at
+`$XDG_CONFIG_HOME/session-peer/update-notices.json`, or
+`~/.config/session-peer/update-notices.json` when that variable is unset or empty.
+The directory and file must be private and safely owned; unsafe paths are refused,
+not repaired or redirected. Invalid or future-schema files hide nothing and are
+not overwritten by either command: inspect the dedicated preference file first.
+Windows does not yet support this per-version preference; ordinary updates,
+checks and the global opt-out remain available.
+
+Safety checks cover POSIX owner/mode bits, not a full ACL audit or physical-media
+durability certification. Symlinked ancestors and explicitly relative config
+paths are intentionally refused without fallback. The filesystem must support
+directory-relative I/O, file locking and directory fsync. After inspecting and
+backing up a malformed preference, an operator may explicitly remove only that
+dedicated JSON file and run the preference command again; do not remove the lock
+file while writers may be running. No automatic repair is performed.
+
 For package-managed installs, use the same manager that installed the command:
 
 ```bash
@@ -441,9 +651,10 @@ session-peer update --host web-01                 # push this program if version
 ```
 
 Remote update compares against the **local program's version**, not the latest
-GitHub release. It pushes even if the remote version is newer; check first and
-update the local program before distributing it. The remote copy does not fetch
-from GitHub. Remote version probes inspect only
+GitHub release. It pushes only if the remote copy is missing or older, and leaves
+a newer remote version unchanged. Check first and update the local program
+before distributing it. The remote copy does not fetch from GitHub.
+Remote version probes inspect only
 `~/.local/share/session-peer/session_peer.py`, not pip/pipx/uv installations;
 remote update installs that standalone path and its CLI link. For a
 package-managed remote CLI, upgrade it with its own manager on that host instead.

{session_peer-1.2.1 → session_peer-1.3.0}/docs/handoff-runtime.md

@@ -32,12 +32,38 @@ For Codex correlation-only mode there is no pending explicit wait: SIGINT after
 
 Verified structured SSH-self addresses keep the local message limit after normalization, including prepared-ID reuse and dry-run. Actual SSH destinations still have the 90,000-character command-argument limit. The protected metadata child additionally bounds each encoded JSON input/output frame to 1 MiB, including UTF-8 encoding and JSON escapes; this can reject otherwise valid local-sized input before submission.
 
-The sender uses one original per-destination budget for metadata, harmless target probing, durable intent, one native effect and cleanup. Its protected metadata child preserves From/Reply and structured SSH-self normalization without renewing detection timeouts. A consumed intent refuses before any new probe. Required remote delivered/acknowledged waits refuse before SSH submission; best-effort requests report unsupported and mint no capability, remote ledger or collector. The effect rechecks the original Claude generation or canonical Codex home/writer context. An explicit Codex generation request is unsupported, not silently removed. Read-only status/wait never invokes SSH submission.
+The sender uses one original per-destination budget for metadata, harmless target probing, durable intent, one native effect and cleanup. Its protected metadata child preserves From/Reply and structured SSH-self normalization without renewing detection timeouts. A consumed intent refuses before any new probe. Required remote delivered/acknowledged waits refuse before SSH submission; best-effort requests report unsupported and mint no capability, remote ledger or collector. The effect rechecks the original Claude generation or canonical Codex home/writer context. An explicit Codex generation request is unsupported, not silently removed. Status/wait never invokes SSH submission.
 
 The probe records an old remote boot-bound monotonic anchor before replying. Only after strict response validation does the sender compute both remaining durations from one original clock sample. The remote effect uses that old anchor plus the remaining durations, including exactly five seconds within the total for cleanup; changed boot, future/expired anchor or malformed context refuses before native effect. No UTC or cross-host clock origins are compared. SSH shutdown does not prove cancellation of remote submission or consumption. Home mapping is the trusted remote handler's actual expanduser/resolve result, including owned symlink aliases; it is not a sender-verified inode, atomic incarnation or universal native storage guarantee.
 
 The actual command must enter the closed private handler before config/source/SSH children start. Hidden options are not authentication: the receiver quotes every external body line once. Strict native profiles and request/target/home/context proofs preserve complete submission evidence after disconnect, timeout, diagnostic overflow or interruption, but never salvage an overflowing protocol stdout prefix. Connection-verified SSH identity and safe reply metadata remain separate from native facts. Private proofs, body, clock anchors and native context are not reflected into public outputs. Owned fake-SSH/source-stream/SQLite/queue fixtures verify this shipped slice, not actual remote hosts, native model consumption or installed reverse-SSH receipt bootstrap.
 
+## Read one request's status
+
+```sh
+session-peer handoff status --correlation-id PREPARED_UUID
+```
+
+Use an existing prepared ID. The human-readable view shows one snapshot from the local owner's ledger: known submission facts, injection observation, ACK assurance and whether it was late, the latest stored wait, retry prohibition and supported next actions. The ACK and wait are shown separately: a late ACK does not rewrite an expired wait. The latest stored wait is not a complete wait history. ACK lateness is relative to the first wait, which may differ from the latest stored wait. Expired or quarantined history shows receipt and injection details as unavailable; a pending ACK without a supported keep-waiting action does not establish that further waiting is available. The JSON field schema and exit-code meanings are retained: a successful query returns 0 and a failed query returns 1; query success is not proof of receipt.
+
+Status does not submit or wake, initialize or repair a ledger, mint receipt authority, or change waits. Its read-only ledger path does not save changes; in-memory retention may still show a tombstone with details unavailable. Explicit quarantine after restore sets submission to unknown and retains terminal waits on disk; the view shows the latest wait only when a valid public snapshot can be formed. Known lifecycle limitation: quarantine clears ACK detail, so a retained satisfied wait cannot satisfy the existing public validator; status refuses with invalid_handoff (exit 1). It does not repair or rewrite that history. This remains a #181 lifecycle gate. Existing status logic may query an already-running collector for clock evidence to determine next actions, but does not start one. The view does not read transcripts or message bodies, or expose raw capabilities.
+
+The collector clock query is also read-only. An older collector may reject that query, so `keep_waiting` may be absent from the available next actions; status does not fall back to a writing query or restart the collector. The ledger snapshot and optional collector clock observation are separate, not an atomic combined observation. After a wait fails with history_unavailable and the collector clock becomes available again, status now preserves known submission and that failed wait without offering keep_waiting. Other wait-creation semantics are unchanged. A tombstone's latest-wait detail is shown as unavailable due to expired history, not as evidence that no wait was requested.
+
+Status remains a single local query. Version 1.3.0 adds bounded local watching below; Windows handoff and Codex ACK remain unsupported. See [#296](https://github.com/abruption/session-peer/issues/296) for the implementation history.
+
+## Watch one request for a bounded period
+
+```sh
+session-peer handoff watch --correlation-id PREPARED_UUID --watch-timeout 30 --interval-ms 1000 --json
+```
+
+Watch polls only an existing local owner's POSIX ledger. The timeout accepts ASCII integers 1..60 seconds (default 30); the interval accepts ASCII integers 1000..5000 milliseconds (default 1000). It takes at most 61 samples and emits an initial snapshot only if the budget permits a valid public projection, then only changes to public metadata or historyPhase; it may emit no snapshots. It is not a lossless event stream. Known submission, ACK assurance, ACK lateness relative to the first wait, and the latest stored wait retain the status view's separate meanings. A local observation time in UTC is not ACK arrival time or ordering evidence. historyPhase is prepared, attempted, terminal, tombstone or quarantined; attempted means a durable attempt fence, not active execution.
+
+JSON output is NDJSON using the common schemaVersion 1 envelope with watch-specific fields: operation is watch and event is snapshot or end. A snapshot nests the unchanged public handoff object; normal status JSON is unchanged. Deadline completion returns 0 and means only that watching ended, not that an ACK arrived or a wait succeeded. SIGINT returns 130; history or output failure returns 1. Missing/corrupt history or a changed ledgerEpoch stops the watch without inventing a handoff or epoch. The existing quarantined satisfied-wait refusal remains the #181 lifecycle gate described above.
+
+Each output frame is limited to 16 KiB, total output to 256 KiB, with 2 KiB reserved for the end frame. For real-fd stdout, one owned isolated output-only Python helper receives only bounded public serialized bytes and never changes shared descriptor flags or reads ledger/native data. The parent enforces the original total deadline, including helper IPC, and checks it before new ledger read or validation stages. It reserves 100 ms within that total for final output and cleanup, so sampling may end earlier. The parent terminates and reaps its helper on timeout, SIGINT or error. Uninterruptible OS operations still prevent a hard-real-time guarantee. After a partial or unacknowledged write, no subsequent frame, including end, is sent; consumers must reject a truncated final NDJSON line. A helper completion reply proves OS write completion only, not recipient consumption. Watch does not read native bodies or transcripts or expose capabilities or payload/capability digests; public targetGeneration remains unchanged under its existing contract. It does not create intents, waits or receipts, submit, wake, initialize, repair or write the ledger. It may use the existing read-only clock query on an already-running local collector, never launch a collector or native message process. Host/device routing and Windows watching are unsupported; no Codex ACK support is added. The read-only ledger releases its shared lock after reading immutable snapshot bytes, before parsing and validation. Interrupted final output and cleanup are capped at 100 ms within the remaining total budget. Overall success requires a complete successful end frame and exit 0: cleanup may fail after that frame. A nonzero exit means overall failure, without promoting ACK, discarding independently valid submission facts or permitting retry.
+
 ## Evidence, privacy and timing
 
 A complete inbox write is submission, not consumption or turn completion. Only an authenticated correlated receipt, or a separate explicit operator attestation with provable ordering, produces acknowledged. An early receipt during native write/drain is saved as bounded unclassified evidence. It is classified only after independently known submission and original-clock ordering; classification cannot invent a receipt or backdate an ACK. A committed ACK survives collector restart; unused authority expires conservatively on restart. Duplicates still require original token-hash proof, including after expiry. Manual confirmation never rewrites an old wait.

{session_peer-1.2.1 → session_peer-1.3.0}/docs/i18n-manifest.json

@@ -7,23 +7,20 @@
     "zh-CN"
   ],
   "sources": {
-    "README.md": "9ccd334628d9bb03bba3a08d0fd67a46ab48124733e4cf0b6565f034680db441",
-    "RELEASING.md": "b2371ba9b2392e3b95394bb6bb3c2927b0c87ff3a8b307bc90defdad6f0ab8a6",
-    "SECURITY.md": "8f018f6f98002312e143609b9734aeb971ca5217e146597c06b57b5645031046",
-    "docs/README.md": "03a461054c1570741c2022685014a1b947f0234145b83f4c8297241d5edcf327",
     "docs/agent-adapters.md": "bf185d3121c94829bb412071a25c4d943302e10a6b2e713111e653b8f8c3ea91",
     "docs/ai-assistant-guide.md": "9624ec96b92fb688fae3be3c94cb3564c77985091be451fbf1f056a1af9b9d9c",
     "docs/antigravity.md": "f2b5122a0ce6e6fb5bd4d8ed50ce2c8bd2dc9c98ec8ce328405cf7c2cd24229d",
     "docs/architecture/agent-transports.md": "01a4e3942e87acb476595859f2e37f9653ea1e3bc19ebc68dced1adf20a6966f",
-    "docs/cli-reference.md": "43e9e3232d8975d3e6b17065f40f43ff590184cac503d2c8fdae05142668334b",
+    "docs/cli-reference.md": "803668e9cc554e76ec9dabbb29560a7d2cbd9357370edccc9aa97eabcbc8c38a",
     "docs/compatibility-v1.md": "7e551aad37a369faff7e370728376763efb54c2c9e9cfd8556a0c19aabc3d103",
     "docs/contracts/handoff-v1.md": "46a953010c49214bd8f969412f26713384fbe09a0ba78ebf0fef75da40d0d889",
     "docs/diagnostics.md": "0949e53612eeab2cd7c7bbda498e14d71e9cb1b1189aa7722030cb8702cd8481",
     "docs/download-metrics.md": "ded60e7b84d14ce779f8d639516b4e390358a06ef76b677dc9c1f997fb626a9f",
-    "docs/handoff-runtime.md": "b2ecd28949dabd8b0c63371a1d3e8d732a2dcd07ce972e5737241732b4991dfb",
+    "docs/handoff-runtime.md": "a236e48392c91eca0f7c3734a6008a991955ae66d16fd71f97691aac5bf0091f",
     "docs/mcp.md": "a64010cdd63f2cde6a0052450bed2d05faa0f19c93c76143cb0d585d36f8ff62",
     "docs/multi-home-list.md": "f8d8e3adf727e4842ea7c4d45e8f6523b11d0513bf2509d4d1204645875e6489",
-    "docs/paired-devices.md": "44c70f99d3f8f8ff9f6f86d128913ada69f4cc4e794c724cfc214f7f8ea78f20",
+    "docs/paired-devices.md": "08c2643d08f769deb725c6123193c1ea9593c775afde84a158a41fe6e7d1be82",
+    "docs/README.md": "775fbf51947b2adca22df3fa5a3bcbec3262a22280b488ba3169997afe6ebbe5",
     "docs/relay-auth.md": "e6da5291ce6a9da31e79e66ceeff7e9fef7e95046359acbf04d708c96ffab62f",
     "docs/relay-development-plan.md": "0abf750b36275ea4e467a0020e560277f08689f2d574aed7674133705383b1ff",
     "docs/relay-edge-policy.md": "c1c7f7a1c4303943c78ca334dab4034f66c0c272e40c007d07c3da2a496155eb",
@@ -52,9 +49,13 @@
     "docs/releases/v1.1.2.md": "3ffe3d6daa8e403e9f3c5e83ec81c3afa9f10750627b31362990ec5b92326f3a",
     "docs/releases/v1.2.0.md": "9a153493fb3d25306306a05f6c1f5672d7d7becfe008f371770ce2d13d7e9b38",
     "docs/releases/v1.2.1.md": "70a3026c2d874a6fd7addcaef840ecfa84bf4f33a0165605217379acffa4fddb",
+    "docs/releases/v1.3.0.md": "a422901b83c85cfb48ac0ad2f99dbc82dca46c4929a3016acd15010e4a18188b",
     "docs/validation/69-rc.md": "e490c6a9ad0fec9108b91c74922cedac7ddf214ed405f8f5523da22f48a4b222",
     "docs/validation/85-antigravity.md": "f89b175191cd98ab03d4029b487065133814b3c8dd8de8cd0a5cc367e2579e4f",
     "docs/wake.md": "cde135da2ea7be21c815bb265e694f737dbe467d8e76bb82eb118e3b86e29d22",
-    "plugins/session-peer/README.md": "a4eeae54caac9ad824d740f7f319561f060bc9c2bbbbf7def2bdd8e36dbcd1c6"
+    "plugins/session-peer/README.md": "a4eeae54caac9ad824d740f7f319561f060bc9c2bbbbf7def2bdd8e36dbcd1c6",
+    "README.md": "0141cec936141c2bb13283b29440ad5c398f38bbc27ddb20013ff5e46175dadc",
+    "RELEASING.md": "9e99dd741b4d221064664176b9c09f972ae4d82379f0ac4479853832dacad042",
+    "SECURITY.md": "8f018f6f98002312e143609b9734aeb971ca5217e146597c06b57b5645031046"
   }
 }

{session_peer-1.2.1 → session_peer-1.3.0}/docs/ja/README.md

@@ -23,6 +23,8 @@
 
 ## 開発と履歴
 
+- [v1.3.0リリースノート](releases/v1.3.0.md)は、マージ済みの6機能、対応する組み合わせ、リリース検証を説明します。
+
 - [v1.2.1準備記録](releases/v1.2.1.md)は、Orca Claude検索・スキルメタデータ読み取り・互換スキルコピーの2026-10-19パッチ候補を記録し、公開は別です。
 
 - [v1.2.0公開記録と過去の準備](releases/v1.2.0.md)は2026-10-16の公開と、2026-10-15に開始し2026-10-16に更新した準備、マージ済み6件のPRの範囲と残る受け入れ条件を区別します。