session-peer v1.4.2

session-peer v1.4.2

Maintenance release covering bounded test-fixture pipe waits and CI guardrails (#372), plus localized operator-guide terminology and documentation verification (#374). Runtime behavior changes only in the version value. Source: 27b088735f065b6785dc6f3892cf132926657bdf.

No new native/SSH/ACK/platform qualification or operational rollout is claimed. The compatibility skill remains separately published v0.5.1 with minimum 0.9.1/full documented coverage 1.4.0; publication does not update independently managed skills or restart services.

Verified publication

• GitHub stable/Latest, immutable release: 2026-11-05T09:45:30Z.
• PyPI 1.4.2: wheel uploaded 2026-11-05T09:47:52.170326Z; sdist uploaded 2026-11-05T09:47:54.295391Z. Both are non-yanked and match the locked, attested candidates.
• Preparation run and publish/PyPI verification run succeeded. All seven asset attestations, exact manifest/provenance/source checks and fresh wheel/sdist installations passed. Required human PyPI approval was retained.
• Wheel SHA-256: fb9a409603daeca922c325a65c7c1d164d41f517b68af9244d4fd6d806fb9317.
• Sdist SHA-256: 98a227a6cd9e72f801ba677a453edca8b81317648af456bc6e3bd9845bb0add8.

Frozen preparation record

The dated candidate/authority statements below describe the preparation checkpoint, not current GitHub or PyPI availability. Actual publication evidence is recorded separately; existing source notes and immutable assets are not rewritten.

v1.4.2 maintenance release preparation

Prepared on 2026-11-05 against published v1.4.1 (GitHub, PyPI). At this dated checkpoint, v1.4.2 is an unpublished maintenance candidate. Integrated maintenance base: c265861d5251f8bab65229521444168e23bc13a9, before version preparation, not the final release commit. The owner requested release preparation; this does not authorize merge, tag/draft creation, workflow dispatch, publication or operational rollout.

Scope

• PR #372 addresses #370 in the handoff watch test fixture: pipe observations have deadlines, helper output is checked before the interrupt finish window, and missing-frame/warm-up failure regressions verify bounded failure and helper cleanup. CI limits each POSIX test-matrix job to 15 minutes and its core-test step to 5 minutes, with faulthandler enabled for fatal-signal tracebacks. These are test/CI repairs, not a product runtime defect fix or proof of the cause of the original CI stall.
• PR #374 addresses #373 across the Korean, Japanese and Simplified Chinese READMEs and operator guides. It distinguishes handoff confirmation/ACK information, persisted paired-request processing results, historical Control operation results and SSH host-key verification records; corrects related operational terms; clarifies existing English discovery/configuration descriptions; and strengthens heading-hierarchy and wrapped-inline-code checks. Existing queued/submitted, consumption and ACK boundaries are preserved.
• Runtime behavior is unchanged apart from the version value. The frozen English handoff contract and its golden contract fixture remain unchanged; PR #372 changed the separate watch-test helper. No new feature, native/SSH delivery, Windows 3.14/free-threaded Python, consumption/ACK guarantee or platform-support qualification is claimed.
• #316 Relay test/shutdown monitoring, #367 paired-device aggregate discovery and Long-term research remain separate. A successful rerun does not establish the cause or resolution of a historical incident.

Compatibility and independent skill

Core Python 3.9, MCP Python 3.10+ and SDK requirement mcp>=1.30,<2 are unchanged.

The prospective SKILL.md support asset remains the published skill v0.5.1, source 95cf5e1dd92654775b2f0ea86c1cb4b6107f49c3, 31688 UTF-8 bytes, SHA-256 922512869577cc3d8b9d305641479e2dd659f0e669298584ca06f1ca15de1d31. Metadata remains skill 0.5.1 / minimum runtime 0.9.1 / documented full coverage 1.4.0; receiver codexBin floor remains 1.0.1. This runtime patch does not raise those floors or release a new skill. Exact source/hash pinning does not itself assert GitHub-enforced immutability. The support skill remains outside wheel/sdist.

Existing tags, immutable assets and dated preparation/publication records are preserved. Package publication does not update independently managed skills or other global MCP environments, restart receivers or deploy Node Control services.

Publication gates

Require successful checks/reviews of the exact preparation head and final protected-main source. Any later authorized publication must verify all 7 frozen assets (including SHA256SUMS and release-provenance.json) and authenticated attestations against the exact tag/source, run current dependency audits and fresh wheel/sdist installation checks, and retain the required human PyPI environment approval. These are pending gates, not completed results claimed by this preparation. Omitting a private login/binding recheck does not waive human approval or permit a protection bypass.

Freeze these publication-neutral dated notes before a later authorized build. Record actual GitHub/PyPI publication evidence separately; do not announce publication early, reuse a version, move an existing tag or replace immutable assets. Release preparation and operational deployment are separate.

session-peer v1.4.1

v1.4.1 maintenance release preparation

Prepared on 2026-11-03 against published v1.4.0. At this dated checkpoint, v1.4.1 is an unpublished candidate. The integrated maintenance base is 192b77ec4a168859c26fe886ff42901f24060608, before version preparation, not the final release commit. The owner authorized the release; normal repository protections, current-head review and final protected-main CI still apply.

Scope

• PR #366 adopted the separately published skill v0.5.0; PR #369 synchronized the compatibility copy to v0.5.1 and added four-language v1.4.0 publication records and current status guidance. This patch packages that documentation and compatibility-copy maintenance. Runtime behavior is unchanged apart from the version value; no runtime defect is claimed fixed.
• The prospective SKILL.md support asset is the published skill v0.5.1, source 95cf5e1dd92654775b2f0ea86c1cb4b6107f49c3, 31688 UTF-8 bytes, SHA-256 922512869577cc3d8b9d305641479e2dd659f0e669298584ca06f1ca15de1d31. Metadata remains skill 0.5.1 / minimum runtime 0.9.1 / documented full coverage 1.4.0; receiver codexBin floor remains 1.0.1. Coverage is not raised to 1.4.1 merely because this runtime patch carries the copy. The skill release API reports immutable=false; exact source/hash pinning does not imply GitHub-enforced immutability.
• The immutable runtime v1.4.0 SKILL.md asset remains skill v0.4.1. Existing tags, assets and historical preparation/publication records are preserved. A runtime package upgrade does not update independently managed skills or other global MCP environments, and does not restart receivers or deploy Node Control services.
• #370 records an unbounded read in a test fixture under injected output failure; the original CI stall cause remains unconfirmed. This patch does not fix #370. #367 paired-device aggregate discovery and Long-term research remain separate. No new feature, live Native/SSH, Windows 3.14/free-threaded Python, consumption/ACK or platform-support qualification is claimed.

Core Python 3.9, MCP Python 3.10+ and SDK requirement mcp>=1.30,<2 are unchanged. The support skill stays outside wheel/sdist.

Publication gates

Require successful checks/reviews of the exact preparation head and final protected-main source. Build and verify all 7 frozen assets, SHA256SUMS, release-provenance.json and authenticated attestations against the exact tag/source, then run dependency audits and fresh wheel/sdist installation checks. These are pending release gates, not results asserted by this preparation. Required human PyPI environment approval remains even when the private login/binding recheck is skipped; do not bypass protections or move a published tag.

Freeze these dated notes and add actual GitHub/PyPI publication evidence separately. See the v1.4.0 publication record for the previous release. Publication and operational rollout remain separate.

session-peer v1.4.0

v1.4.0 release preparation

Prepared on 2026-11-02 against published v1.3.3. At this dated checkpoint, v1.4.0 is an unpublished source candidate. The integrated base is f290973962c63548f24153eeee12a8e3666fd043, before version preparation; it is not the final release commit. This preparation authorizes no merge, tag, draft, workflow dispatch, publication or operational rollout.

Core Python 3.9, MCP Python 3.10+ and SDK requirement mcp>=1.30,<2 are unchanged.

Changes

• #356 / #361: add MCP list_destinations returning only policy-derived metadata, bounded to 64 aliases, 128 UTF-8 bytes per alias and 64 KiB per tool result, excluding the JSON-RPC envelope. This metadata query also works with policy version 1 and the default policy; it does not require policy version 2. It projects all configured policy entries without filtering by list/Send permission.
• #357 / #362: add single-target CLI --dry-run --explain-json delivery explanations. Raw SSH facts are captured before legacy output shaping; existing text and JSON output retain their contracts. MCP preflight_send requires the separate preflight capability in policy version 2; preflight never implicitly grants Send. Wake preflight also needs its separate wake capability, starts no model and reserves no wake budget.
• #358 / #363: add metadata-only diagnostics requiring the diagnostics capability in default mode. Active probing additionally requires diagnostics_probe, supports Mac/Linux only, and limits execution to 3 agents and 20 seconds excluding cleanup, with each pipe and the result bounded to 64 KiB. Nonblocking readers handle escaped pipe holders; cancellation wins during cleanup.
• Selected doctor agent/home scopes the actual collection; shared skill scanning is skipped. An OK result means collection succeeded, not agent availability, DB attestation or a reverse probe.
• #359 / #364: add policy version 2 route presets with approved names and exact action routes. Complete both checks before any Native invocation: first the route, then its revision; actual send requires an explicit target and revision. One snapshot and its dp1 fingerprint are neither destination identity nor ACK. Existing list/send JSON remains unchanged; safe query paths do not fall back to repair. Presets remain limited to Mac/Linux local/SSH Claude Code and Codex routes; wake, URI, Antigravity, device, handoff and Windows support is not expanded.
• Release preparation also defensively rejects MCP preflight response-root fields from the ordinary native protocol (submitted, consumptionConfirmed, status, dryRun, queueId), which the fixed send.preflight schema does not contain. No normal production CLI counterexample, misrouting or security incident was observed; this guard adds no capability, protocol, ACK or permission. The internal MCP process helper now honors an explicitly supplied timeout while the default 130-second CLI_TIMEOUT behavior remains unchanged; this correction makes no claim of impact on current normal callers or of an outage.

Exact source and validation

The merged sources are #361 444959c08acadc85ec48722c03354a3905fac174, #362 e68f1c8f224f30701a9b69bb693f4e99055880ee, #363 7f85cb12cf6661db2facd5d74b2b31d7ee8514bd and #364 f290973962c63548f24153eeee12a8e3666fd043.

Integrated-base CI succeeded with 37 jobs, and CodeQL succeeded at the same base. This is integrated-source evidence, not validation of the preparation's final head or the final protected-main release source.

Independent skill compatibility

The existing compatibility copy and prospective SKILL.md support asset remain the independently published Python skill v0.4.1, from source 263b0c333d539dc4e885b16ae3369a26f33097d8: 27126 UTF-8 bytes, SHA-256 fdf5697c04f4a37194986622afb3a7966bb02631c128cf18a323e3fbe5ae90ed. Its minimum runtime 0.9.1, documented full coverage 1.3.2 and receiver codexBin floor 1.0.1 are unchanged. The support copy stays outside wheel/sdist.

A separate skill 0.5.0 proposal would retain minimum 0.9.1 and document full coverage 1.4.0 only after actual runtime publication and separate approval. A later snapshot PR must verify the exact skill tag, source and hash. An absent future tag does not block this runtime preparation; never relabel changed bytes as skill 0.4.1. This preparation does not publish or install that proposal.

Boundaries and release gates

These extensions add no new live Native/SSH, Windows 3.14 or free-threaded acceptance, ACK/deduplication/handoff guarantees, owning app-server support or support promotion. Unknown roles and unknown outcomes retain their limits; queued submission is not ACK, and uncertainty never authorizes automatic retry.

Review the exact current head, require successful current-head checks and final protected-main CI, and preserve every published v1.3.3 tag, asset and historical record. Freeze these publication-neutral dated notes. A separately authorized publication must verify all 7 frozen assets, including SHA256SUMS and release-provenance.json, against the exact tag/source and authenticated attestations, run dependency audits and fresh installation checks, and retain required human PyPI environment approval. Skipping the private PyPI login/binding recheck does not waive that approval.

Record actual GitHub and PyPI publication evidence separately before updating availability statements; do not announce a future publication. Python publication, global MCP environment upgrades, service changes, Node Control deployment and independently installed skills remain separately authorized operations.

v1.3.3

v1.3.3 maintenance preparation

Prepared on 2026-10-30 against published v1.3.2. At that preparation checkpoint, v1.3.3 was an unpublished candidate. The integrated source base is ec2f7fc808f1e22519348091d51c28a2fd522caf, before version preparation; it is not the final release commit. This work prepares a reviewable change only. It does not authorize merge, tag creation or publication.

Changes

• #349 / #352: refresh the PR template to default to non-closing Refs, make intentional completion explicit, and request relevant validation and version evidence. A read-only warning uses code from trusted main and a limited PR-body heuristic. It neither executes body text nor writes issue state, and it is not GitHub's complete closing-reference parser or a guarantee against closure.
• #350 / #353: extend standard, GIL-enabled CPython 3.14 CI on Ubuntu/macOS. Core covers 3.9/3.13/3.14 on Ubuntu/macOS and retains Windows 3.13; MCP keeps SDK floor 1.30.0 and latest compatible 1.x profiles across 3.10/3.13/3.14 (12 cells), and Relay covers 3.11/3.13/3.14 (6 cells). Three packaging/install cells cover Ubuntu 3.13, Ubuntu 3.14 and macOS 3.14. The classifier includes 3.14; Python floors remain core 3.9, MCP 3.10 and Relay 3.11. See the source test matrix.
• #351 / #354: use version-neutral publication guidance in current READMEs, add a separate dated v1.3.2 publication record, preserve historical preparation records, make the existing post-publication checklist explicit, and correct the four-language Direct guide's stale unpublished label.
• Synchronize the compatibility snapshot and prospective SKILL.md support asset to the independently published Python skill v0.4.1. This is a compatibility-copy update, not a new skill release or an update to separately installed skills.

Exact source and compatibility

The merged sources are #352 6f9026e46138db544fb9c990387fcd4ccf37400f, #353 88f2c906e3f4bae8b377fcfac049a65fd68dea64 and #354 ec2f7fc808f1e22519348091d51c28a2fd522caf.

The skill snapshot comes from commit 263b0c333d539dc4e885b16ae3369a26f33097d8 in abruption/session-peer-skill at tag v0.4.1, annotated tag object ba08d19af33cad0f7d032b7fe18c82d6ddd6793f: 27126 UTF-8 bytes, SHA-256 fdf5697c04f4a37194986622afb3a7966bb02631c128cf18a323e3fbe5ae90ed. Its version is 0.4.1, basic runtime minimum 0.9.1, documented CLI coverage 1.3.2 and receiver codexBin floor 1.0.1. These numbers are independent of runtime 1.3.3. The support copy is outside the Python wheel/sdist.

Boundaries and release gates

The 3.14 checks are fixture and package validation, not new live native-agent, Windows 3.14 or free-threaded Python acceptance. The version bump and documentation changes add no runtime authentication, protocol, delivery or ACK behavior. Existing unknown-outcome/no-automatic-resend and experimental-feature boundaries remain.

Integrated-base CI and CodeQL succeeded for the source base above. These results do not replace checks of the preparation head or final protected-main source. The 10 new 3.14 cells passed in the initial CI before the classifier was added, and the updated full CI passed after that addition.

Keep all published v1.3.2 tags/assets and its dated records unchanged. Review the exact preparation head and require successful current-head checks, then successful protected-main CI before any later release step. A separately authorized publication must verify all 7 frozen assets, including SHA256SUMS and release-provenance.json, against the exact tag/source and authenticated attestations, test fresh installations and retain the required human PyPI environment approval. Skipping a private PyPI login/binding recheck does not waive that approval. Use the existing post-publication documentation checklist after actual GitHub and PyPI evidence exists; do not announce availability in advance.

Preparation performs no service deployment/restart, global installation or independent skill publication. Node Control deployment and receiver/skill environment updates remain separately authorized operations.

v1.3.2

v1.3.2 maintenance release

Prepared on 2026-10-28 against published v1.3.1. Direct-feature source base: dac1c30b1553136b9379be0c6d94eef34ccbad51; this is not the final integrated release commit. These notes describe the preparation scope; check GitHub Releases and PyPI for publication records.

Gate-fix source base after PR #345: a68c6cf16c234cd3fe72926e519e4178c093081a. Integrated preparation base after merged PR #347: ef7748a78e6b466f67074708f5c14decf37f31d7, before the version-preparation commit. Final publication evidence identifies the release commit separately.

Changes

• #341 / #342: receiver startup preserves ready:true and adds directReadyConfirmed:false, distinguishing local listener setup from remote reachability. TLS completion alone does not prove pairing, native-target access or ACK.

• Opt-in --diagnostic-events adds Direct callback/TLS observations with bounded per-receiver accepted, tlsCompleted and tlsFailed counters. The accepted and peer_tls phases permit at most 2 records per 60 seconds in total; TLS success/failure share the latter phase limit. Normal close attempts 1 additional summary, including zero counts, without repeating it on repeated close. Fixed fields omit addresses, peer/session IDs, message data and exception text. Logging failures do not replace handshake exceptions. Existing synchronous stderr has no hard deadline for a blocked sink.

• The experimental TCP probe catches asyncio.TimeoutError on Python 3.9/3.10 and has a stalled-loopback regression test on Python 3.9/3.13. Manual two-Mac/tailnet experiments remain separate from CI; experiments/ is excluded from wheel/sdist. See the experiment record.

• #343 / #345: update Node Control's exact better-auth and @better-auth/core versions from 1.7.5 to 1.7.7, with aligned adapters/telemetry. Upstream lists 1.7.7 as the first patched version for GHSA-965c-763c-88jm (critical), GHSA-r4xp-prcw-77qf (high) and GHSA-44jh-23m7-hpcf (low).

• #344 / #345: synchronize the SIGINT test fixture so READY is announced only inside the protected read. This addresses the observed macOS Python 3.13 race between signal termination (-2) and the expected handled exit 130; it changes test synchronization, not product signal behavior. No fixed sleep or weaker assertion is a substitute for that boundary, and the exact cause of historical CI failures is not established.

• #346 / #347: raise the optional MCP SDK requirement to mcp>=1.30,<2. The core Python 3.9 floor and MCP Python 3.10+ marker remain unchanged. POSIX CI defines 8 cells: Mac/Linux, Python 3.10/3.13 and 2 SDK profiles, exact floor 1.30.0 or latest compatible 1.x. Transitive dependencies resolve normally; the floor profile does not certify every package's minimum version. Installed standard-input/output (stdio) contract checks do not establish HTTP/OAuth exposure or exploitability.

PR #345 has merged the two separately reviewed gate fixes, and PR #347 has merged the MCP floor/CI-profile work. The reviewed PR #347 head passed 32 checks, including all 8 MCP cells; its automatic Codex code/security reviews separately completed without findings. These PR results do not replace final protected-main validation or publication evidence. Require successful current-main checks before merging the release-preparation PR.

Incident and compatibility boundaries

After the owner allowed Python.app's incoming connections, both Macs completed Direct pairing and authenticated probes using the original released session-peer v1.3.1 on the Homebrew Python 3.14.9 runtime, the same tailnet bind addresses and per-machine ports, fresh test identities and zero native calls. No forwarder or alternate interpreter was needed. This supports pending macOS Application Firewall approval as the blocker in this incident; the diagnostic code did not restore the connection. Earlier negative/signature/forwarding controls are historical evidence, not required remedies or a universal macOS/Tailscale/Python diagnosis.

Direct binds, TLS/authentication checks, deadlines, pairing state and no-automatic-retry behavior are unchanged. No firewall, access policy or runtime selection is automated, and no platform or general ACK support is added. Existing user pending state was not retried or reset. Native generation, handoff, storage and startup acceptance (#180/#181/#268/#304/#306/#307) and Side Session/steering research remain separate.

The optional Relay receiver module changes are included in wheel/sdist, not embedded in standalone session_peer.py. Applying the diagnostics requires updating the receiver's own package/environment and explicitly restarting its process; a standalone-file update alone does not update those modules. This release performs no operational update or restart.

The inspected Control source uses bearer and deviceAuthorization plugins with SQLite, not the Magic Link/OAuth Proxy/PostgreSQL paths named in the advisories; deployed exploitability was not established. The Node Control dependency patch is outside the Python wheel/sdist and requires its own separately authorized service rollout. Review the upstream OAuth verification-identifier prefix changes and coordinate upgrades across servers sharing verification storage; pending OAuth sign-ins may need to be started again after the update. This preparation performs no operational rollout, session revocation or data migration.

The compatibility skill remains v0.4.0, minimum runtime 0.9.1 / documented CLI coverage 1.3.0; receiver codexBin retains its 1.0.1 floor. Its unchanged SHA-256 is debedd472e3b0c0c6844fb63f7fb2f17cb6c6cc8c3e981e9afd2531a35327af7. Runtime publication does not update independently managed skills or deploy running services.

Release verification

Local gate-fix validation passed 123 Control tests, 11 Node/Python integration tests, 17 stdin tests on each of Python 3.9/3.13 and 400 controlled signal attempts; dependency audits reported 0 vulnerabilities. These local results do not replace protected-main CI or live OAuth acceptance.

Local Mac MCP validation passed 28 MCP tests in each of 4 SDK/Python profiles, with dependency audits reporting 0 vulnerabilities; current documentation checks passed 69 tests. These local results do not replace the 8-cell CI matrix, final main checks or HTTP/OAuth acceptance.

The #342 verification record includes 354 Relay tests, 65 documentation tests and 1 probe regression tested on Python 3.9/3.13. These are implementation evidence, not new native-agent acceptance for this preparation. Require current preparation review, protected-main CI, dependency audits, generator consistency, reproducible artifacts and fresh installations. After preparation succeeds, verify all 7 immutable assets (including SHA256SUMS and release-provenance.json) and their authenticated attestations against the exact tag/source before publication. Required human PyPI environment approval remains. Existing v1.3.1 assets and operating installations are not replaced by this preparation.

session-peer v1.3.1

v1.3.1 maintenance release

Prepared on 2026-10-27 against published v1.3.0. These notes describe the source scope; check GitHub Releases and PyPI for publication records.

• #338 / #339: update Node Control's transitive Zod dependency from 4.6.5 to 4.6.7 for GHSA-mrhx-c7xc-m3w5, which affects versions below 4.6.6. Direct dependencies and audit policy are unchanged. This addresses the locked dependency advisory; exploitability against deployed endpoints was not assessed or reproduced.
• #334 / #335: include the byte-identical compatibility skill v0.4.0 from companion source 176dc0dab619f074dbfc94de7e01f9a02a052f79, SHA-256 debedd472e3b0c0c6844fb63f7fb2f17cb6c6cc8c3e981e9afd2531a35327af7. Minimum runtime remains 0.9.1; documented CLI coverage is 1.3.0; receiver codexBin still requires 1.0.1. The standalone release's skill asset does not update independently managed skill installations.
• #336 / #337: show cumulative PyPI download counts in the four README variants.

Python CLI behavior, dependencies, supported platforms and experimental handoff limits remain unchanged from v1.3.0 apart from the version identifier. Node Control source is outside the Python wheel and sdist; publishing or installing the Python package does not remediate a running Control service. Applying the Node fix requires a separately authorized Control source/dependency update and restart.

Local verification of the dependency fix: clean npm installation, typecheck/build, 123 Control tests, 11 Node/Python loopback integration tests, and runtime/full npm audits with zero reported vulnerabilities. These are fixture results, not live OAuth, native-agent or deployed-service acceptance. Require final PR review, protected-main CI, dependency audits, reproducible artifacts and fresh installation checks before publishing.

Use a new v1.3.1 tag and verified immutable assets. Existing v1.3.0 assets remain unchanged. Native generation, handoff, storage and startup acceptance (#180/#181/#268/#304/#306/#307) and Side Session/steering research remain separate. Unknown delivery outcomes never authorize automatic resend.

session-peer v1.3.0

session-peer v1.3.0

Source and publication status

Prepared on 2026-10-23 against published 1.2.1. This document records the release scope and verification gates; it does not announce package availability. Check GitHub Releases and PyPI for publication records.

The integrated source base is a0e7af032fd372334782cc3ac3d97b21c71dd797, before the version-preparation commit. The six feature PRs were merged in this order: #329, #330, #331, #332, #325, #328. Integrated CI and CodeQL passed for that base; they do not substitute for checks on the final release commit.

Included changes

• #323 / #325: text explanations for send --dry-run --explain, doctor --explain and handoff status --explain. They describe existing results and recorded evidence, including supported paired readiness context, without granting permission or proving consumption. An old receiver may leave context unknown. Stored receipt evidence is distinct from a new observation.
• #324 / #328: optional route presets and a separate recipient addressbook for local/SSH Claude Code and Codex on Mac/Linux. Actual address sends require the current --address-revision and exact --confirm-target; selection and writer checks are repeated. Revisions do not authenticate people or prove atomic native generation or storage identity. Windows, paired-device and Antigravity addressbook operations remain unsupported.
• #296 / #329: bounded POSIX handoff watch observes an existing intent. It does not create a submission, resend, collector or new receipt authority. It retains the experimental handoff scope and existing unsupported channels.
• #312 / #330: explicit trusted SSH configuration support. A trusted configuration can execute local SSH commands; this is an operator trust decision, not a sandbox. Existing target checks and uncertain-outcome handling remain.
• #212 / #331: expiring one-use pairing links and guided setup, using hidden terminal input and independent fingerprint confirmation. Both endpoints need the supported pairing protocol and existing Unix Relay requirements. Pairing does not replace target policy or native approvals; pending-offer cancellation does not revoke a completed pairing.
• #294 / #332: local, per-version automatic runtime-notice dismissal on Mac/Linux, with an explicit clear operation. Management is offline; explicit update checks and skill notices retain their existing behavior.

See the CLI reference, handoff guide and paired-device guide for exact combinations, platform limits and error behavior. The integrated changes also contain regression-test stabilization and an expired-room eligibility fix in the Python Relay (session_peer_relay/relay.py). Applying that fix to a running Relay requires an operator update and restart; no service deployment was performed. Passing reruns alone do not establish the cause of earlier unrelated failures.

Compatibility and remaining work

Python 3.9+ remains the core runtime floor; optional MCP requires Python 3.10+, and the Unix/WSL Relay receiver requires Python 3.11+. Core local/SSH use adds no third-party Python dependency. Ordinary submission results remain distinct from consumption, receipt ACK and task completion. Unknown outcomes never authorize automatic resend.

The GitHub release includes the compatibility SKILL.md asset from published companion 0.3.3, with minimum runtime 0.9.1 and full coverage 1.0.1. The newer companion 1.3 guidance is a separately reviewed document update; it is not included, installed or published by this runtime release. Plugin and TypeScript versions remain independent.

Side Session and steering research (#245/#247, Draft #246/#248) are assigned to Long-term and are not release features. The remaining native generation, handoff, storage and startup acceptance work (#180/#181/#268/#304/#306/#307) is not completed by this release. No general Codex ACK, delivery before a TUI's first input or Antigravity stable-support claim is added.

Release verification

Require current review and CI for the preparation PR, then successful CI and dependency audits on its exact protected-main commit. Verify generated standalone consistency, four-language documentation, package contents and fresh installations. Local integration and build results are rehearsal evidence, not the published artifacts or new live-agent/platform acceptance.

After the authorized tag and draft are prepared, wait for the preparation workflow and its attach-draft job to succeed. Verify all seven immutable assets (including SHA256SUMS and release-provenance.json) and authenticated attestations against the exact tag and commit before publication. Required human PyPI environment approval remains in effect. Record publication evidence separately; do not replace immutable assets to revise these frozen notes.

Package publication does not deploy Control/Relay services or update installed devices. Operational rollout and live acceptance remain separate.

Release source: 938630063b69bf6e0ae69d4b11e2095c30f289f4.

session-peer v1.2.1

Changes

• Find native Claude sessions in known same-user Orca profiles on macOS while preserving explicitly selected configuration roots (#317, #319).
• Read bounded skill frontmatter independently of the full document size, including released companion skills v0.3.2 and v0.3.3 (#318, #320).
• Refresh the compatibility skill snapshot to canonical v0.3.3; skill/plugin versions and manager-owned installations remain independent of the Python package (#302, #303).
• Close the handled-signal staging-ownership window in the POSIX SSH updater and add deterministic HUP/INT/TERM and Bash regression cases (#322, #321). Cancellation waits for allocation to return; SIGKILL, host loss and arbitrary repeated cleanup interruption remain outside this guarantee. Unknown outcomes never permit automatic resend.

Release evidence and boundaries

Reviewed source: f19f2b5e9ac17d392375507bc753548cdfc0e751 (PR #321).

The release preparation workflow builds reproducibly, verifies clean installations and current dependency audits, and attaches seven authenticated artifacts. GitHub publication and PyPI publication are separate; PyPI availability depends on the required human environment approval and successful publisher verification. See the repository Actions results and the PyPI version record for actual availability.

The tagged preparation notes preserve the dated preparation state and test limitations. The existing #316 diagnostics remain monitored, not claimed resolved. No general Codex receipt ACK, original-generation enforcement, arbitrary empty-TUI delivery or stable Antigravity support is added.

Package publication does not deploy Node Control/Relay services or update installed devices. Those remain separately authorized operational work.

session-peer v1.2.0

session-peer v1.2.0

Release source: 4fc526f36afc65bb6ec460439eb0986c09ecc8ee (PR #315), following the protected-main integration of #305, #311, #310, #308, #313 and #314. The exact release commit passed the main CI and CodeQL checks. Package availability is listed on PyPI; GitHub publication and PyPI publication are separate steps.

Changes

• Extend pre-effect Codex storage guards across known system, managed and project configuration layers; inspect the physical queue execution plan and consumer directory before submission or wake reservation (#311). Native shared-daemon routing is unchanged. Passing these checks is not effective-storage attestation or an atomic identity guarantee.
• Preserve the unsupported Codex target-generation boundary, with negative tests against weak writer, queue and turn evidence (#310).
• Add offline handoff lifecycle tests for receipt-channel safety, retention, explicit known-restore quarantine and committed ACK classification across collector restart (#314). This does not add new native ACK support.
• Record scoped macOS/Linux Antigravity 1.3.3 post-registration validation and historical macOS 1.3.4 startup/receiver-bridge observations, with provenance and execution-owner limitations (#305, #313). Antigravity remains experimental.
• Harden the isolated Codex first-input research probe, including server-history checks and 26 offline regressions (#308). Unmaterialized empty TUIs may be refused; this is not general first-input support.
• Update four-language release documentation and publication-neutral package metadata (#315). Plugin and companion skill versions remain independent and unchanged.

Important limits

Standalone list remains metadata-only: it does not execute Codex or query its version. On macOS it conservatively inspects ordinary and forced preferences and may reject newer environments whose native loader ignores ordinary values. Send/dry-run uses bounded native-version evidence (3 seconds plus up to 2 seconds for cleanup); only the exactly reviewed Codex 0.162.1 selects forced-only inspection. Known configuration checks do not establish a running daemon's startup SQLite identity or eliminate configuration races.

Issues #180, #181, #268, #304, #306 and #307 remain open. This release does not deliver native Codex generation/ACK guarantees, full storage verification, general empty-TUI delivery or stable Antigravity support. The frozen handoff contract is unchanged: submitted/queued is not consumption or ACK, and an unknown result never permits automatic resend.

The final preparation's controlled local run completed 1,256 Python tests (19 skipped); earlier intermittent handoff test failures and Relay transport/shutdown diagnostics remain recorded. #316 remains open: successful reruns do not establish a cause, relationship or fix for those diagnostics or the earlier CI exit139. No tests, audits or protections were bypassed.

Distribution and operations

The authorized preparation workflow rebuilds the exact tagged source twice, verifies isolated wheel/sdist installs and current dependency audits, and attaches seven assets: wheel, sdist, standalone Python, installer, skill snapshot, SHA256SUMS and release-provenance.json. Their authenticated attestations must match the exact commit before publication. Local rehearsal artifacts are not release assets.

The current private PyPI Trusted Publisher binding recheck was omitted by the owner, not marked verified; the required human pypi environment approval remains intact. Package publication does not deploy Control/Relay services, update installed devices or prove live native-agent delivery. Operational deployment requires separate authorization and verification.

The dated preparation record preserves the reviewed scope, merge SHAs and remaining acceptance gates.

Publication record — 2026-10-16

GitHub published this stable, Latest, immutable release at 12:39:13 UTC. PyPI published the wheel at 12:41:38 UTC and sdist at 12:41:40 UTC, after the required human pypi environment approval by the repository owner. The publication workflow completed all six jobs successfully, including fresh audits, immutable asset verification, isolated installations and matching the exact published PyPI file set and hashes.

The public PyPI record contains these two non-yanked files, identical to the authenticated locked GitHub candidates:

File	SHA-256
session_peer-1.2.0-py3-none-any.whl	fa2c60a9927deac393bb979590d564bcc80879831536a5a2d782d2ad3ea55fe0
session_peer-1.2.0.tar.gz	89263e1a9fd4277dfb475556039ac83225a34cb4a89360d5e800ed0657cf90ed

This publication record updates release metadata only. The tag, seven release assets and their attestations were not replaced or rebuilt; operational deployment remains separate.

session-peer v1.1.2

session-peer v1.1.2

Reliability patch for #298, based on published 1.1.1. Source commit: f3993bf8988dd301b7e14402e63e8ac04e5e2300 (PR #309).

Changes

• Invalid or oversized Claude PID records no longer prevent healthy sessions from appearing in discovery or diagnostics.
• Nondecimal Unicode session names such as ² resolve by name rather than failing integer conversion.
• Native PID parsing is bounded before OS process inspection. Valid decimal PID addressing, permission diagnostics and Windows process-start/PID-reuse checks are preserved.
• The standalone CLI and four-language release preparation documents are updated.

Validation and limits

PR checks passed 28/28. Local Python 3.13.7 full suite passed 1,104 tests (18 skipped); Python 3.9.6 core suite passed 559 tests (3 skipped). Wheel and sdist built and passed isolated installation/version checks. Publication requires successful exact-main CI, reproducible release preparation, dependency audits and authenticated immutable artifacts; the PyPI upload retains its required human environment review.

Exact-main CI and CodeQL passed. Release preparation passed all five jobs, including reproducibility, wheel/sdist installation, current dependency audits and attachment of exactly seven candidates.

These checks do not establish new live Claude/Codex/Antigravity/SSH delivery, fleet or operational acceptance. Experimental handoff retains its existing opt-in scope; submissions are not consumption or ACKs, and unknown outcomes never authorize automatic resend.

Package publication does not deploy Control/Relay services or update installed devices. Historical RC4 ACK evidence remains 20/21; #161 remains monitoring with its root cause unconfirmed.

The tagged source's preparation notes and README retain their pre-publication wording. This release record and the separate PyPI version record establish actual publication state.