investigate(mcp): expose scoped handoff status and bounded observation #360

Problem

The MCP server explicitly has no received/status/wait tool. Existing experimental handoff CLI state could support narrowly authorized inspection and bounded waiting, but a shared MCP process cannot authenticate the calling native session and must not reveal another caller's receipt authority or results.

Proposed scope

Investigate and, after a reviewed contract, expose status and bounded observation for an existing operator-authorized handoff intent. Prefer existing read-only watch semantics. Existing handoff wait writes wait history and uses a non-read-only collector query; exposing actual wait would require a separate write-capable policy/annotation decision. No new send/prepare/ACK capability, task journal, native observation, receipt transport or generic reply matching is included.

Acceptance criteria

• Define how an operator authorizes the caller's access to particular existing intents. A model-provided intent/task ID or the MCP launcher's session identity is insufficient authority.
• Resolve the shared-launching-user ledger boundary before exposure; without operator-scoped access that isolates callers, keep the tool unsupported. Authorize before any ledger read. Accept no model-supplied ledger path.
• Deny cross-caller enumeration and disclosure; never return receipt capability material, private ledger paths, message contents or unapproved results.
• Preserve published CLI platform/transport and history/restore restrictions. Unsupported native Codex observation/ACK, Windows, remote/device/fanout combinations must not become supported merely through MCP.
• Report existing state/evidence without upgrading submitted/queued, queue IDs, turn completion or a plain-text reply into consumption or ACK.
• Status inspection and waiting never prepare a new intent, native-send, mint receipt authority or automatically resend. Explicitly document any permitted existing-runtime maintenance/housekeeping effects rather than claiming metadata-only behavior without verification.
• Read-only status/watch is local POSIX only and never initializes/repairs history, creates wait records, starts collectors or changes ledger bytes. Only an already-running collector's existing read-only clock query is permitted. Watch completion is not wait satisfaction, receipt, task completion or ACK.
• Waiting has hard input limits, bounded deadlines/output and cancellation cleanup. Cancellation ends observation; it does not retract a possible earlier submission.
• Preserve unknown/history-unavailable/quarantine distinctions, late-ACK assurance, no-retry semantics and immutable existing handoff contract/fixture behavior.
• Add isolated temp-ledger/collector and stdio tests for authorized/foreign IDs, cancellation/timeout, missing/corrupt/restored history, duplicate/late ACK and zero native effects.
• Keep any MCP Tasks/progress integration optional and separately capability-negotiated; no assumption that SDK/client support exists and no conflation of task completion with agent ACK.

Related work

Depends on a reviewed MCP authorization model. Coordinates with #181 and #296; it does not close their broader incomplete acceptance. This issue is a scoped MCP adapter follow-up, not a replacement for the existing native/upstream research.

Source: MCP limitations, handoff contract.

Planning

Long-term investigation, priority P3; no release/date commitment. No implementation, live/native experiment, new caller authentication, merge, publication or operational approval is implied.

Tracking dependencies

Depends on #356 and a separately reviewed caller/ledger isolation model; unsupported isolation is a blocker. Coordinates with #181/#296. This is outside the v1.4.0 candidate milestone and does not broaden native ACK support.