feat(receipt): add explicit local authenticated receipt bootstrap

PARITY.md

@@ -1426,3 +1426,11 @@ the exact proposed skill 0.3.0/min0.1.0/full0.4.0/probe-help tuple after design/
 review of the complete Draft #37 fixture. That fixture is not a published skill
 or installation pin; final skill bytes require renewed exact review. A new runtime
 version is never automatically compatible by numerical ordering.
+
+## Explicit local receipts — #132 source implementation
+
+The implementation candidate follows the owner-selected [local bootstrap design](https://github.com/abruption/session-peer-ts/blob/d922d6e20345f10b914ee9cf4da40476fd044f5d/docs/design/receipt-bootstrap.md): manual local collector, explicit private-input authority delegation and a separately invoked receipt-only handler. Existing generation-bound Codex v1 semantics remain intact; Claude delegated-context v2 keeps native generation unknown and proves only token possession. This is separate from manual `operator_confirmed` evidence.
+
+Managed format-2 state has one live collector owner and no migration/import/recovery path. Original user-payload digests remain privately encrypted; raw capability values are never persisted by sender/collector. Fast pre-outcome receipts cannot promote an unknown native submission, reopen an effect fence or rewrite terminal wait results. Receipt/status/wait operations have no native submission path. Codex token delivery uses qualified private-stdin RPC only; ordinary argv-based queue submission is never a token-bearing fallback.
+
+The [operator guide](docs/guide.md#explicit-local-receipts) and [API contract](docs/api.md#explicit-local-receipt-bootstrap-source-implementation) describe the opt-in scope. Existing platform/native qualification, same-version SSH rules and independent skill pins remain unchanged. Windows managed storage, reverse-SSH collectors, automatic services, wake, automatic model ACK, resend and exactly-once claims remain outside this implementation. Transcript-derived Claude observation #73 was explicitly closed NO-GO; that decision does not prohibit voluntary receipt submission.

docs/api.md

@@ -407,3 +407,28 @@ voluntary receipt producer/authenticated collector bootstrap [#132](https://gith
 are future extensions. An automatic collector would still require an explicit
 receiver receipt; it must never infer ACK from messages or turn completion.
 Unsupported required goals refuse before effect; no post-attempt fallback or resend.
+
+## Explicit local receipt bootstrap (source implementation)
+
+The `receipt` owner commands and `send --receipt-collector SOCKET` select a local, manually operated receipt route. They do not start services, discover alternate collectors, wake a session, answer an approval or resend a native message. Read the [operator guide](guide.md#explicit-local-receipts) before supplying private receipt input.
+
+- `receipt init` creates a fresh managed format-2 store. Existing unmanaged format-1 history is not migrated or adopted. New legacy owner commands refuse a managed context; managed status and waits require the live collector.
+- `receipt serve` is a foreground process with a single mutation and monotonic-clock owner. A second owner refuses. Unexpected state/key/endpoint replacement is not repaired. Cleanup may be unconfirmed; that does not authorize removal of an unrelated path.
+- `receipt respond --receipt -` accepts only a bounded private receipt frame on stdin, through the explicitly selected private endpoint. A successful invocation records authenticated receipt evidence only; it cannot send a message. Never put capability data in argv, environment, URI, shell command text or public output.
+- The generic CLI envelope stays `schemaVersion:1`. Codex's nested handoff/receipt stays v1 with the original non-null native generation. Claude uses a separate nested handoff/receipt v2 with `targetGeneration:null` and `receiptContext:{kind:"delegated_context",id:UUID}`. A v1 validator must reject that new scope rather than synthesizing a generation or downgrading it.
+- `token_possession` means delegated receipt authority, not native/model identity, consumption, completion or responsibility acceptance. Existing `operator_confirmed` evidence remains a separate manual assurance. The intended recipient's native queue/history may retain delegated authority.
+- Codex delegation uses only the qualified owned RPC route with private stdin. A token-bearing body is never passed through a native `--message` argument or a legacy queue fallback. Unsupported required ACK refuses before effect. Best-effort unsupported bootstrap can retain ordinary submission facts without minting an unused token.
+- The original ACK operation is opened before the effect fence and uses the original total budget. A fast authenticated receipt can occupy one reserved candidate slot until positive native submission is recorded. Unknown/refused outcomes cannot be promoted by that receipt. ACK eligibility is classified through the collector's serialized transition; it never backdates an ACK or rewrites a terminal timeout.
+- Each independent wait has its own immutable operation ID/deadline. Polling does not open another wait, extend authority or submit native input. A fresh collector cannot revive unused old-clock authority. Committed receipts and terminal waits are retained.
+
+IPC is separately versioned and limited to the closed receipt operations described in the [reviewed design](https://github.com/abruption/session-peer-ts/blob/d922d6e20345f10b914ee9cf4da40476fd044f5d/docs/design/receipt-bootstrap.md). Request/response frames are at most 16,384 bytes including LF; each raw private receipt is at most 4,096 bytes. The collector admits at most 16 live connections, with finite per-read/write and total exchange budgets. Unknown post-attempt responses never authorize automatic retry. These bounds do not promise a deadline for arbitrary kernel-blocked filesystem I/O or protect against a hostile same-user writer.
+
+Windows managed storage and reverse-SSH receipt collection remain unsupported. Existing native observation qualification remains unchanged. OS/IPC fixtures, synthetic native transports and actual live-agent receipts are separate evidence categories; this source description is not a release or live-model qualification claim.
+
+### Original-budget IPC 2 and retained-context limits
+
+Private IPC 2 `hello.clockReferenceMs` is an opaque collector monotonic reference. A client captures its remaining total milliseconds after that reply and echoes the fixed reference/span in `wait-open`; the actor anchors the original cutoff to the earlier reference. Network, preparation and mint latency cannot start a renewed wait budget. This does not depend on clocks sharing an origin or on UTC comparisons. Public CLI/receipt/handoff version namespaces are unchanged by the private IPC revision.
+
+Explicit revoke/quarantine rejects further receipt presentations, including duplicates, while owner status retains committed ACK evidence. TTL expiry alone does not erase the authenticated identical-receipt retrieval exception. A late flag refers to the first recorded wait; a later wait cannot renew it. Context limits apply jointly: the current conservative 64-KiB retained reservation can fill a 32-MiB store at about 511 small intents before the separate 10,000-record upper bound. There is no automatic retirement or deletion. A full-store refusal never authorizes dropping history or resending.
+
+Before a managed intent is established, bootstrap refusal can have no handoff IDs; the client does not fabricate an epoch/correlation/operation for unavailable storage. Once an operation is established, its original verified IDs/deadline and independently known native facts are preserved on later failures without inventing a durable terminal result.

docs/design/receipt-bootstrap.md

@@ -568,3 +568,16 @@ a prerequisite and cannot enable transcript-derived ACK in this design.
 
 No implementation, platform qualification, live receipt, delivery/ACK result,
 merge, release, installation or operational change is claimed by this proposal.
+
+## Implementation review refinements — 2026-11-03
+
+The following reviewed implementation choices refine the earlier proposal; they do not change existing receipt/handoff v1 or enable a published release:
+
+- Private bootstrap IPC uses **`ipcVersion:2`**, not the historical proposal's IPC 1. Public CLI schema 1, generation-bound Codex receipt/handoff 1, delegated Claude receipt/handoff 2, managed-store 2 and producer challenge protocol 1 remain separate namespaces.
+- `hello` returns a required non-secret `clockReferenceMs`, an opaque coordinate from the live collector's monotonic clock. After receiving that response, the client samples its original total remaining milliseconds exactly once. It does not interpret or compare the collector coordinate with its own clock.
+- `wait-open` adds required `clockReferenceMs` and `remainingMs` to its closed wire body, retaining the original `timeoutSeconds` cap. The collector bounds the span by that cap and anchors `cutoff = reference + remaining - cleanup`. Because the reference precedes the client's remaining-budget measurement, later prepare/mint/IPC delay cannot renew the original deadline. No UTC authority or cross-process absolute-clock assumption is introduced. A future reference, missing pair, invalid integer or oversized span refuses.
+- A terminal ACK/timeout that wins a stop race is read once using the original operation ID. It is not relabelled as a stopped wait or persistence failure. Actual stopped-by-operator results use exit 130; an immutable timeout uses exit 1.
+- Explicit revocation/quarantine refuses further receipt presentations, including duplicate receipt retrieval; the committed ACK remains available through owner status. This preserves existing v1 behavior. TTL expiry alone retains the authenticated read-only identical-receipt exception while detailed history remains available.
+- `late` remains anchored to the first recorded wait, including an insufficient-budget terminal wait. Later waits do not renew that originating cutoff or rewrite earlier terminal results.
+- The intent count and journal bounds apply together. A conservative 64-KiB retained reservation per intent can exhaust the 32-MiB store at about 511 small intents, before the separate 10,000-intent upper bound. There is no automatic deletion/reset/retirement engine. A full store refuses new managed work; discarding history never proves safe resend.
+- IPC read/write/total durations are upper bounds, not promised minimum service time. The client currently uses a stricter one-shot two-second collection budget capped by its remaining total; a post-attempt timeout is unknown, not permission to retry.

docs/guide.ja.md

@@ -88,6 +88,26 @@ Relay 通信、MCP、wake/resume、Antigravity、自動更新は未実装です
 
 別の探索先でエラーが起きても読み取れたセッションは一覧に残し、探索が不完全であることを診断情報と失敗終了コードで示します。送信と送信者の識別には、完全で矛盾のない根拠が必要です。同じ実体の登録ディレクトリを指す別名は一つの行にまとめられますが、PID や inbox の情報が競合する場合は、ディレクトリの順番や PID の指定では解決しません。選択と handoff の連続性検査は元の登録情報の根拠を保持し、提出直前に再確認します。一覧と dry-run は inbox に接続しません。これらの検査は native の世代、メッセージの消費、受領確認 ACK を証明しません。
 
+### 明示的なローカル受領確認
+
+receipt は通常の posted/queued という提出根拠とは別です。所有者が非公開状態を明示的に初期化し、フォアグラウンドの collector を手動で開始します。サービス登録や自動起動はしません。次の `serve` は所有者が停止するまで終了しません。
+
+```sh
+session-peer receipt init --state-dir "$HOME/.session-peer-receipts" --json
+session-peer receipt serve --state-dir "$HOME/.session-peer-receipts" --json
+```
+
+別のターミナルで受領確認用の権限委任を明示的に要求します。受信側は非公開 stdin から receipt 専用 handler を別途呼び出します。下の二つ目のコマンド自体が receipt を取得するわけではありません。トークンをシェルのコマンド文字列、引数、環境変数、URI、公開出力、送信者や collector のファイルに含めず、非公開 stdin/FD で渡せる producer だけを使ってください。許可された受信者の native キューや履歴には残る場合があります。
+
+```sh
+session-peer send --to claude:NAME --message "Receipt fixture" --request-ack --receipt-collector "$HOME/.session-peer-receipts/s" --wait-for acknowledged --wait-timeout 30 --json
+session-peer receipt respond --collector "$HOME/.session-peer-receipts/s" --receipt - --json
+```
+
+`token_possession` は委任されたトークンの所持を示すだけで、モデルの身元、メッセージの消費、作業完了を証明しません。Claude は native 世代が不明な別の v2 delegated receipt context を使います。Codex は元の世代に結び付いた v1 を維持し、非公開 stdin を使う検証済み owned RPC 経路だけを許可します。トークンを native の `--message` 引数に入れる代替経路はありません。既存の手動 `operator_confirmed` 根拠とも異なります。
+
+collector は同じ端末の所有者専用経路です。保存容量の制限が重なり、小さい記録でも約 511 件で新しい受領確認要求を拒否する場合があります。自動削除や初期化で履歴を捨てることはありません。逆向き SSH collector と Windows managed storage は未対応です。明示的な各 wait は自分の期限を維持します。status/wait は非公開の状態分類を書き込む場合がありますが、native メッセージを再提出しません。不明な結果から自動再送は行いません。既存の native・プラットフォーム検証範囲は変わらず、fixture の成功は実エージェントの receipt 検証ではありません。
+
 ## 必要条件
 
 macOS / Linux / Windows native、Node **22.x の 22.13 以上、または 24.x**。Node 26 は対象外です。ネイティブロック依存には対応する x64/arm64 バイナリが必要で、純 JavaScript パッケージではありません。Codex 送信には `codex` が必要で、macOS/Linux では `lsof`・`ps` も必要です。Windows はネイティブロックと Restart Manager で所有者を確認します。Claude にはアクセス可能な inbox を持つ稼働中 TUI が必要です。SSH は既存の鍵・ホスト信頼と、接続先の**同一バージョン**のクライアントを使います。

docs/guide.ko.md

@@ -132,6 +132,26 @@ Claude 이름은 Unicode 14.0.0의 기본 완전 대소문자 접기(full casefo
 
 다른 탐색 경로에서 오류가 나더라도 읽은 세션은 목록에 남기고, 탐색이 불완전하다는 진단과 실패 종료 코드를 반환합니다. 전송과 발신자 식별에는 완전하고 충돌 없는 근거가 필요합니다. 같은 실제 등록 디렉터리를 가리키는 별칭은 한 행으로 합칠 수 있지만, PID나 받은 메시지함 정보가 충돌하면 디렉터리 순서나 PID 지정으로 대상을 결정하지 않습니다. 선택과 handoff 연속성 검사는 원래 등록 정보의 근거를 유지하고 제출 직전에 다시 확인합니다. 목록과 dry-run은 받은 메시지함에 연결하지 않습니다. 이 검사가 native 세대, 메시지 소비 또는 수령 확인 ACK를 증명하지는 않습니다.
 
+### 명시적 로컬 수령 확인
+
+수령 확인 receipt는 일반 posted/queued 전송 근거와 별개입니다. 소유자가 비공개 상태를 직접 초기화하고, 터미널에서 실행 상태를 유지하는 수집기를 직접 시작합니다. 서비스 등록이나 자동 시작은 하지 않습니다. 다음 명령의 `serve`는 사용자가 중지할 때까지 종료되지 않습니다.
+
+```sh
+session-peer receipt init --state-dir "$HOME/.session-peer-receipts" --json
+session-peer receipt serve --state-dir "$HOME/.session-peer-receipts" --json
+```
+
+다른 터미널에서 수령 확인 권한 위임을 명시적으로 요청합니다. 수신자는 비공개 표준 입력으로 receipt 전용 처리기를 별도로 호출해야 합니다. 아래 두 번째 명령이 스스로 receipt를 가져오지는 않습니다. 권한 토큰을 셸 명령문·인자·환경변수·URI·공개 출력·발신자 또는 수집기 파일에 넣지 않고 비공개 stdin/FD로 전달할 수 있는 도구만 사용하세요. 허용된 수신자의 native 큐·대화 기록에는 토큰이 남을 수 있습니다.
+
+```sh
+session-peer send --to claude:NAME --message "Receipt fixture" --request-ack --receipt-collector "$HOME/.session-peer-receipts/s" --wait-for acknowledged --wait-timeout 30 --json
+session-peer receipt respond --collector "$HOME/.session-peer-receipts/s" --receipt - --json
+```
+
+검증 결과의 `token_possession`은 위임받은 토큰의 소지만 증명하며, 모델 신원·메시지 소비·작업 완료를 증명하지 않습니다. Claude는 native 세대를 알 수 없는 별도의 v2 위임 receipt context를 사용합니다. Codex는 원래 세대에 결합한 v1을 유지하고, 비공개 stdin을 사용하는 검증된 owned RPC 경로만 허용합니다. 토큰을 native `--message` 인자로 넘기는 대체 경로는 없습니다. 기존 수동 `operator_confirmed` 근거와도 다릅니다.
+
+수집기는 같은 기기의 소유자 전용 경로만 사용합니다. 보존 용량 제한이 함께 적용되어 작은 기록 약 511개부터 새 수령 확인 요청이 거부될 수 있으며, 자동 정리·초기화로 이력을 버리지 않습니다. 역방향 SSH 수집기와 Windows managed 저장소는 미지원입니다. 각 명시적 대기는 자신의 마감 시각을 유지합니다. status/wait는 비공개 상태 분류를 기록할 수 있지만 native 메시지를 다시 제출하지 않습니다. 결과를 알 수 없다고 자동 재전송하지 않습니다. 기존 native·플랫폼 검증 범위는 그대로이며, fixture 성공이 실제 에이전트 receipt 검증을 뜻하지는 않습니다.
+
 ## 요구사항
 
 macOS, Linux 또는 Windows와 **Node 22.x의 22.13 이상 또는 24.x**가 필요합니다.