feat(handoff): add explicit receipt producer and authenticated collector bootstrap #132

Current roadmap — 2026-10-13 KST

• Target milestone: 0.6.0 — Authenticated receipts and Claude research.
• Planning priority: P1 (priority:P1).
• Dependencies/order: design(handoff): adopt the Python #181 delivery state model and JSON contract #69/feat(replies): add correlation IDs for explicit acknowledgements #70/feat(codex): add opt-in delivery observation by client message ID #72 retained intent and receipt contracts; same-machine collection before reverse SSH.
• Remaining scope: Voluntary authenticated receipt-only producer/collector, never automatic model ACK, transcript inference, wake or resend.

This section supersedes older milestone/version/priority statements below. Existing acceptance criteria, evidence limits and historical records remain applicable. Versioned milestones are provisional planning targets, not committed dates or implementation/live-test/merge/release authorization. P1 means a milestone prerequisite/current-release item; P2 a planned extension/research track; P3 later dependent work.

Scope and priority

P2 follow-up, Future — Agent integrations. User approved 0.4.0 with explicit operator-confirmed acknowledgement and deferred automatic receipt collection/bootstrap. Keep #69–#72 together in 0.4.0; do not infer that a model response or turn completion is ACK. This is implementation planning, not a live test, merge or release approval.

PR #109 has bounded private receipt validation and operator confirmation, but no qualified production receipt producer/collector bootstrap or original-sender SSH collector. Actual manual operator_confirmed tests do not establish token_possession authentication. Existing #73 researches a Claude local receipt probe; it does not cover this shared receipt-only transport/bootstrap.

Acceptance criteria

• Implement a separate versioned receipt-only producer/consumer using the jointly frozen design(handoff): adopt the Python #181 delivery state model and JSON contract #69 contract; the receiver voluntarily submits an explicit receipt. Never infer it by polling messages/transcripts, plain From text, queue deletion or turn completion.
• Bind original epoch/correlation/target/home/generation/receipt ID and prove the original unpredictable capability in constant time. Persist hash-only authority, TTL/revocation and atomic receipt/wait classification; reject wrong/expired/restored/successor contexts and handle duplicates/late receipts without rewriting terminal waits.
• Keep authority out of argv/URI/env/public output/logs/raw sender persistence. Use bounded private input; accepting a receipt records evidence only and cannot send a prompt, wake a session, grant model action permission or redirect generic delivery.
• Qualify same-machine collection first. Original-sender trusted reverse SSH requires an explicitly installed handler and confirmed route; source-streamed/no-handler capability stays unsupported. No implicit installation or SSH trust relaxation.
• Validate restart/crash/clock continuity, private storage/fencing/resource quotas, concurrent ACK/timeout and zero native submissions for status/wait/receipt/confirm. Lost authority is not regenerated.
• Required unsupported ACK refuses before effect; best-effort sends preserve native facts and report unsupported. No retry/dedup/exactly-once implication.
• Add deterministic producer/collector fixtures and separately authorized isolated live tests before support claims; distinguish operator_confirmed from token_possession in every locale.

Related #69/#70, #73 and PR #107/#109. Body-reading Claude probes, Relay/MCP, work-completion attestation and automatic model answers remain outside scope.