feat(handoff): add private correlation ledger and evidence CLI

[abruption]

Current review correction checkpoint — 2026-10-18 KST

Exact head 5b878fc8cc8a5120af5870a56156f8ae769bc6b8 fixes the three additional current-head findings:

• Bind prepared Claude intents to private registry/socket continuity evidence; PID reuse, record replacement and same-path socket replacement refuse before delivery. Public generation remains null.
• Protect the message-binding digest in the journal with AES-256-GCM and a separate private ledger.key, bound to epoch/intent ID. Missing/changed/untrusted keys and old plaintext journals fail closed without automatic migration. Checksums/quota use ciphertext. A reader of both files is outside this journal-only protection.
• Finalize the original wait operation by operationId, preserving other pending/terminal waits and established evidence. Duplicate committed operator confirmation returns the original receipt without rewriting journal bytes or classification.

Local macOS arm64 Node24.16.0: focused71/71; full273 total /268 pass /0 fail /5 Windows-only skips. Build, types, package/reproducible isolated install/uninstall, shorthand, repository and diff checks pass. These are fixtures, not new native/model/SSH-host/ACK qualification. Frozen design bytes, runtime version and published skill pin remain unchanged. Earlier checkpoints below are history.

Converted Draft while correcting, then Ready on this exact head for fresh automatic reviews. Current-head CI/CodeQL and Code/Security reviews remain merge gates; no manual review mention or bypass. User-authorized order106→107→108→109; release preparation only, no publication.

---

Review correction checkpoint — 2026-10-17 KST

Exact head 746ce8b31b1b08540d9021b73aa2e0f9e9e060d1 addresses all three P2 findings on5a0323d. Source behavior is narrower/moreconservative, not a scope extension:

1. Classify every pending delivery wait against its own immutable cutoff using one observation instant; latest ACK wait cannot hide older operations. Foreign clocks fail conservatively; terminal waits remain unchanged.
2. Retain a protected fingerprint of the selected inactive Codex home/database/lock evidence across prepare/send. Public generation remainsnull; changedlock or replacedDB refuses before fakequeue. Unchanged control queues once with ACKunsupported/retryfalse.
3. Permit keep_waiting only when the requested evidence channel is exactlypending; reject unrequested/completed channels and missinggoal. Frozen positive timeout/stopped fixtures with stillpendingchannels remainvalid.

Original regression evidence: ledger2fail/1pass, inactivebinding2changedcasesfailed whileunchangedcontrolpassed, validator2fail. Afterfix focused54/54, full256total/251pass/0fail/5Windows-onlyskips, build/types, package/reproducibleinstall/uninstall, shorthand/repository/diff checks passed. No native/userdelivery/ACK test. Sourceandnewtests are six files; frozencontractbytes/version/skillpin unchanged.

Converted Draft while correcting then Ready onthisnewhead to trigger freshautomaticCode/Securityreviews withoutmanualmentions. CurrentheadCI/reviews are newgates; older12/12results do not qualifythisfix. Normalexact-headsquashmerge waitsforthem. CompanionguidancecandidatePR37 isnowavailableforcontentreview; it isnot a publishedskill orfinalprofileapproval.

---

Authorized sequential merge checkpoint — 2026-10-17 KST

User-authorized sequence106→107→108→109 and0.4release preparation. This supersedes earlier Draft/no-merge checkpoints below; publication remains a separate step.

• Exact head 5a0323d9c31572fe75f8ea2c0b32784f1adf2fe9; applies only107's12owncommits after actual106squash 81d1aece70b414b6aef00641076bd2716f630f6e.
• Full local tests247total/242pass/0fail/5Windows-onlyskips; build/types, package/reproducibleinstall/uninstall, shorthand, repository/diffchecks passed. First run exposed one outdated added SSHfixturebanner; it was corrected0.3.5→0.3.6 before the full passing rerun.
• Existing literalfiledash/stdin/wire regression and CloudJSON/argvfixture guards preserved. Main0.3.6VERSION/finiteprofileguard/publishedskill0.2.1pin, strictordinarySSH/nativefacts/Windows exit handling retained.
• Frozen contract bytes and reviewed Python1.1.0 oracle remain intact. New current-headCI/CodeQL and automaticCode/Securityreview (Readytrigger) must complete before exact-head-bound normal squashmerge.
• Companion0.4guidance candidate requested once under STS-040-SKILL-CANDIDATE-20261017-A after useractivation. queued is not consumed/reviewed; no newskillprofile/pin/publication is assumed.

---

Earlier history (superseded source/status checkpoints)

Current refresh checkpoint — 2026-10-14 KST

• Exact head: 6363cb7d9b86d7eacf0ad2a2e3c51325d50230c8; latest published main base: a2057940ba19056fcaaa5551a7820f7414bd3bfa.

• Rebased sequentially in dependency order docs(handoff): record the jointly frozen v1 design #106 → feat(handoff): add private correlation ledger and evidence CLI #107 → feat(app-server): add bounded guarded queue-only client #108 → feat(observation): add scoped metadata projection and bounded local waits #109. Each PR keeps base main for current-head full CI and CodeQL; later branches contain the preceding source dependencies and must be reviewed/merged in that order. This is branch preparation, not an integration merge into main.

• Local macOS arm64 checks: 246 total; 241 passed; zero failed; five Windows-only skips. Scoped handoff 14/14; build, types, repository/diff and reproducible package/install/uninstall checks passed. An initial run failed the old 0.3.3 SSH fixture banner; the final head corrects it to 0.3.5 and the full rerun passed.

• Conformance used the existing exact exported published Python 1.1.0 source 8ca77cf31254c8287a2593fe484bb30a7dba2727; hash-pinned oracle tests executed. Frozen contract bytes/hashes and historical validation records are preserved.

• Published 0.3.5 version, finite skill matrix/pin, strict ordinary SSH response handling and Windows exit propagation are retained. No new native/live delivery, automated ACK or Linux/Windows observer qualification is claimed.

• Current-head Actions completed successfully; automatic reviews remain a separate gate. Earlier green checks below are historical and do not verify this refreshed head. Draft, human review gate, no merge/tag/release/publication.

• Final exact-head CI: 12/12 SUCCESS, CLI 38488648720 and CodeQL 38488644825, including both Windows-native Node 22/24. No rerun/bypass. Branch-scoped CodeQL open-alert API returned zero alerts. No new automatic Code/Security Review completion is claimed. GitHub reports MERGEABLE; the PR remains Draft.

---

Earlier PR history (superseded heads/checkpoints)

Scoped 0.4.0 review coordination — 2026-10-11 KST

The user approved keeping #69/#70/#71/#72 together with narrowly qualified macOS arm64 observation and explicit operator-confirmed receipts. Linux observation #130, Windows observation/private storage #131 and voluntary receipt producer/authenticated collector bootstrap #132 are Future extensions. No automatic ACK from text/turn/queue deletion, resend or receiver dedup is claimed. Required unsupported goals still refuse before effect.

This PR's own head remains 16cbd25e5bc254f3e7b7351d3dd4f2c2bbd8f73c and its narrower source/evidence below is unchanged. Integrated scope/docs and added pure-validator/ACK/SSH tests are in PR #109 at d830ccaa1a459bfec0f3c67e2b0e682d99bc7734; that integration does not retroactively qualify this standalone head. Companion skill guidance remains pending in session-peer-skill #31. Human review/merge order remains #106 → #107 → #108 → #109 with current-main checks. No merge/version bump/tag/release/publication is performed by this coordination.

Current verification checkpoint — 2026-10-11

Head: 16cbd25e5bc254f3e7b7351d3dd4f2c2bbd8f73c. The ordinary conformance reference now pins published Python 1.1.0 at 8ca77cf31254c8287a2593fe484bb30a7dba2727; selected source hashes are checked before conformance tests. The ordinary list/discovery comparison does not establish full handoff, receipt or SSH runtime parity.

The published handoff document and fixture are byte-identical to frozen design commit 99d8ec3855d57da34a6fa789f3a375820a8fbe85. Fixture SHA-256 is 963b94e78f510c2535e405813558275d512a5bfe6bbd99ffdf0994b4d2e6e441. Any older checkpoint claiming a different published fixture hash or changed negative vectors is superseded. Frozen bytes and the historical Python 1.0.3 design baseline are unchanged.

Local Node 24.16.0/macOS arm64: build and type checks passed; npm test: 241 total / 236 passed / 5 Windows-only skipped, zero failures. Package smoke, bash/zsh shorthand contract/lifecycle, repository metadata/links and diff checks passed. Current-head Actions are pending after this push; prior green checks are not presented as new-head success. Draft and human merge gate remain in place. No version bump, merge, tag, release, global installation or publication.

---

Earlier checkpoints (history)

Current checkpoint — 2026-10-11 KST

Exact head: df90a2cf9578bd56965a8ce7e44ef0058cbab670. Refreshed against published 0.3.3 main c0ed30273b9e9c0049df86ae3c38486a94289527 using fast-forward branch updates and integration merges; the earlier Cloud CodeQL fixes are retained. This stays Draft, refs #70, within the unchanged four-issue 0.4.0 milestone.

Changes in this checkpoint

Classify each concurrent receipt/confirmation wait against its own cutoff, preserve immutable terminal waits, and reject receipt ordering when an older pending wait has an unprovable restarted clock. Validate archived waits independently of the latest operation actions. Align the unsolicited-SSH-evidence fixture with the current exact-version gate, and feed stdin only to the fixture command that actually consumes it.

Validation actually performed

• macOS arm64, Node 24.16.0; existing exact Python 1.0.2 conformance source 47c23713d0a2a3c11ebde6186afd8c43489b8b65, extracted from the local reference repository. No runtime/reference repin.
• npm test (including build and test:types): 241 tests, 236 pass, 0 fail, 5 Windows-only skips.
• npm run test:package: bash/zsh contract + in-place fixture-version lifecycle, reproducible package, isolated install/uninstall pass. Repository checker, release helper pack/artifact, npm audit (0 vulnerabilities) and diff check pass. These are unpublished validation tarballs, not the public 0.3.3 bytes.
• Synthetic private homes, DBs, writer/SSH/native tools only for the new regressions. No user session delivery, transcript read, live injection/ACK, installed Codex 0.162.1 queue call, or Windows/Linux native qualification was performed.
• The initial integrated full run failed on the stale 0.3.1 SSH banner fixture and on EPIPE from supplying stdin to an immediate-exit version probe. Both fixture problems were corrected; the focused 18/18 run and final full run passed.
• Exact-head CI: 12/12 SUCCESS, including macOS/Ubuntu Node 22/24, Windows native 22/24, repository policy, release gate, CodeQL and GitGuardian. CLI run, CodeQL run; no reruns. These are fixture/CI results, not broader native integration qualification. No new current-head Codex review is posted as of this check; historical reviews are not counted, and no manual review mention was posted.

Remaining gates

Automated receipt producer/collector bootstrap, generation-safe native ACK qualification, Windows private ACL storage and original-sender SSH coordination remain unsupported.

Required unsupported goals refuse before native effect. No fallback/retry after a possible native submission; queued/posted is not receipt ACK or completion. The milestone remains incomplete. No merge, release/version bump, npm publication, tag, protection change, operations change or issue closure is requested by this checkpoint.

Earlier implementation/validation record (historical checkpoint)

Scope

Refs #70 and #69. Part of 0.4.0; Draft, not a release or a claim of completed automated ACK support. Stacked on the exact jointly frozen design in #106. The vendored normative document/fixture hashes and historical runtime reference remain unchanged.

• Add private POSIX sender ledger with explicit init/prepare, original destination/generation/body binding, synced before-effect fence, retained epoch/tombstones and bounded quotas. Unknown supplied IDs and repeat real submissions refuse; missing/corrupt history never authorizes retry.
• Add opt-in send correlation/evidence flags and local status/wait/receipt/operator-confirmation commands. Default native status/field absence/exits stay intact. Query/receipt commands make zero native submissions; private stdin is bounded and strict, including BOM/duplicate/numeric-token rules.
• Preserve independently positive native acceptance if subsequent persistence fails. Required unsupported waits refuse before effect; best-effort requests keep native success while reporting unsupported channels. No transcript scan manufactures ACK and no receipt secret is exposed in argv/output.
• Bind generation from the selected original writer fingerprint, recheck storage before fencing, consume prepared reservations on definitive final refusals. Reply-To-derived SSH cannot bypass the ledger. Validate prefix symlinks before creation.
• Document source-only support and package all new runtime modules explicitly. Package version remains 0.3.1; no publication action.

Validation

macOS arm64, Node 24.16.0; pinned existing Python reference 47c2371.

• Full npm test: 198 total / 193 pass / 0 fail / 5 Windows-only skips at d208ec2.
• Subsequent strict-input/budget patch 069d177: build, test:types and CLI 5/5 pass; no runtime tests claimed for unexecuted platforms.
• Core tests 35/35 include actual process crash after durable fence, cross-process flock, wrong/duplicate/late/restart receipts, retention, quota, original generation and delivery qualification.
• CLI fixtures cover no-effect prepare/dry-run/query, PID target name:null, exactly one synthetic inbox submission, duplicate refusal, unsupported required ACK, symlink prefix refusal and injected post-submission persistence failure preserving native facts.
• Checkpoint 069d177 package smoke, repository checker, release pack/artifact and diff checks passed. Later 8499c8e/9ae30eb add outer-frame reservation and unsolicited SSH handoff stripping, with focused build/types/regression checks and latest exact-head CI success. Reproducible local package SHA-256 4376d1786f437a0b94b42dd0810acf0728d5b4198642876ebcbda4afcd832898 (local check only).
• Independent read-only review findings were corrected with targeted regressions; no actual user sessions/messages or accounts used.

Remaining implementation gates

Production receipt producer/collector bootstrap, restart-safe Claude generation, Windows private ACL support, original-sender SSH ledger coordination, full operation setup cancellation and live/platform qualification remain open. CLI ACK therefore remains unsupported unless an independently qualified internal producer has minted authority; the CLI does not mint such authority. This PR does not close #70 or split the milestone. No merge/stage/tag/fleet changes.

Latest head: 9ae30ebf12909a0b2dd6eb34c12cf10adf83ef28; all eight CLI jobs and GitGuardian success. Stacked-base CodeQL remains a main-retarget gate.

[abruption]

Review findings corrected and propagated through the implementation candidates. All three Draft PRs now target main; each exact current head has successful macOS/Linux Node22/24, Windows Node22/24, release gate, CodeQL (Actions and JavaScript/TypeScript) and GitGuardian checks.

• feat(handoff): add private correlation ledger and evidence CLI #107 / 52f233d: message-file contents are literal. Open stdin with different data cannot replace file '-' or block submission. --message - still reads stdin; framed SSH body '-' is literal. Old code reproduced a wait; new CLI fixtures7/7 pass.
• feat(app-server): add bounded guarded queue-only client #108 / 53a656b: close/timeout/error/exit stop the registration lifecycle, detach spawn callback and prevent late re-registration/reaping. Immediate-close test delivers a delayed spawn event plus captured queued callback, verifies listener baseline and no second fake-PID reap. Old-code negative control failed; current app-server32/32 pass. No foreign process is signalled by the test.
• feat(observation): add scoped metadata projection and bounded local waits #109 / f6c283c: SIGINT first retrieves the originating operation, and fence/submission/catch keep that projection. Regression adds another wait before effect, withholds queue response and interrupts: original stopped/exit130, submitted:null, newer terminal unchanged, exactly one queue attempt/no resubmit. Old-code negative control failed; delivery6/6 pass.

Combined focused build/types and45/45 fixtures pass locally. main-target exact-head CI/CodeQL success supersedes the earlier stacked-base gate note. Implementation release gates and Draft status remain; no merge/publication performed. Dependency review order stays #106 -> #107 -> #108 -> #109 despite their main comparison targets.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-17T15:11:35.767597Z	5b878fc	Draft marked ready
🔒 Security Review	✅ Completed 2026-10-17T15:14:49.462449Z	5b878fc	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 5a0323d9c3

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 746ce8b31b

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".