Repository navigation
feat(discovery): add opt-in local destination presets and address book #324
Description
Problem
Users working across multiple machines and Codex homes repeatedly reconstruct the same host/home/agent/recipient arguments. Session-peer already supports those routes and explicit target selection; the missing piece is a convenient local way to remember destinations and choose the intended current session.
Reference baseline: Python v1.2.1, source f19f2b5e9ac17d392375507bc753548cdfc0e751. This is a presentation and selection feature, not a team identity service.
Proposed scope
Design an opt-in, user-owned local address book or destination presets. A user supplies a friendly person/project label and supported route/agent/target selectors. Group explicitly requested discovery results by those labels and display the concrete resolved destination before use. CLI/config spelling and override precedence remain design choices.
Reason Network's person/machine/session directory is the UX reference: design. Start with local configuration and explicitly selected destinations; no shared roster, always-on daemon or transcript-derived work summaries.
Acceptance criteria
- Specify a bounded configuration schema, owner-only storage, validation, update/removal behavior and precedence between presets and explicit CLI options. Store no credentials, executable commands or receipt secrets.
- Reuse existing local/SSH/paired route validation; do not allow presets to introduce alternate SSH hooks, implicit pairing, policy changes or automatic native-home selection.
- Distinguish reusable route presets from snapshot-bound recipient bindings. A friendly label is not authenticated person identity, a generation token or proof of current ownership.
- Show canonical target and route context; reject ambiguous/conflicting matches. Preserve explicit home selection and existing writer/storage checks.
- Never silently rebind an originally pinned recipient, inherit old mail into a replacement session, or reuse approval for a changed destination. Require explicit reselection where the saved binding no longer applies.
- Revalidate before actual submission; preserve unsupported generation and unknown/no-resend semantics. This feature must not claim atomic Codex ownership guarantees.
- Query only destinations the operator explicitly selects, with existing finite limits and visible partial failures. Do not scan a network or automatically publish local session metadata.
- Cover duplicate labels, missing/invalid config, changed host/home/recipient, conflicting overrides, partial discovery and malicious labels with offline fixtures.
- Document the supported initial route scope and four-language examples. No automatic MCP/hook installation or group broadcast.
Relationship and planning
Use #323 for capability/readiness explanations and #296 for already-created handoff intent status. Reuse existing guided setup (#211) rather than reopening its completed work. #180/#268 remain independent identity/storage investigations; this address book cannot substitute for their guarantees.
Priority P2; v1.3.0 planning candidate, second among the Reason-inspired UX slices. Research remains the owner's current priority. Registration does not authorize implementation, new live experiments, deployment or release.
Activity
abruption commentedon Oct 23, 2026
The owner-approved additional implementation is now in PR #328 at
d004928f7eeb9f9985f23730d90b0bfd80f92ddd.This adds a separate saved-recipient store, explicit observation/revision/target confirmation, CAS reselection, grouped bounded discovery, verified SSH host-key pinning, and existing native ownership/generation guards. Mac/Linux local/SSH Claude/Codex is the approved scope; Windows, paired-device and Antigravity address bindings are excluded rather than advertised as implemented. Codex generation remains unsupported, and writer observations are not atomic incarnation or SQLite-attestation guarantees.
Claude Opus 5.5 and Codex CLI independent reviews were completed before the push. Confirmed findings were corrected with regressions, and Gemini 3.8 Flash Medium reviewed the four-language documentation. The PR describes exact versions, evidence hashes and limits.
Focused tests: 59 pass on Python 3.9 and 3.13; documentation: 65 pass; generated standalone and diff checks pass. Current-head CI and isolated sibling-feature integration are being checked separately. Local native permission tests are constrained by the required external volume; the PR explicitly separates controlled-metadata fixtures and reproduced baseline failures from ownership-enforcing CI.
This issue remains open pending normal review/merge and explicit disposition of excluded follow-up scope. No release, live delivery experiment, global installation or operations change was performed.
abruption commentedon Oct 26, 2026
v1.3.0 release closeout — 2026-10-26
Closing as completed for the owner-approved release scope, following the owner's milestone cleanup instruction. The original proposal/checklist is retained as history; this is not a blanket assertion of every platform or broader research guarantee.
Route presets and a separate recipient address book are published for the approved Mac/Linux local/SSH Claude Code and Codex scope. Bounded private storage, explicit target/revision confirmation, CAS reselection, grouped discovery and effect-boundary writer checks are covered.
Evidence: merged PR #328; published v1.3.0 scope, source
938630063b69bf6e0ae69d4b11e2095c30f289f4; successful publication and artifact/install verification. Static source/test-definition recheck today: tests/core/test_addresses_storage.py; tests/core/test_address_selection.py; tests/core/test_address_send_guards.py. Two read-only subagent audits independently reviewed the split issue groups; no new mandatory closure blocker was found. No new tests/live experiments or deployment were performed during this closeout.Remaining boundaries: Explicit disposition of excluded scope: Windows, paired-device and Antigravity address bindings remain unsupported and unscheduled, not completed by this issue. No current requirement warrants creating duplicate expansion issues. Friendly labels/writer observations are not identity or atomic-generation/storage proofs; #180/#268 remain open.
Retain the closed issue in v1.3.0 as the release record. Optional excluded expansions are not automatically promised for another release.