v0.4.0 — Scoped delivery observation and explicit receipts

Highlights

• Opt-in Handoff v1 correlation, private POSIX prepare/status/wait records and durable sender fencing. Ordinary sends retain their existing result fields and exits.
• Qualified client-ID injection observation for exact Codex 0.160.1/0.162.1 on macOS arm64, with original home/writer generation and an already-warm supported metadata store. Injection observed does not mean understanding, task completion or receipt ACK.
• Explicit operator-confirmed receipts with immutable per-operation deadlines and late-evidence history. operator_confirmed is an operator attestation, not model authentication. Wait/status/confirmation never resubmit the native message.
• Bounded same-version SSH destination preparation and request-matched evidence preservation. Budgets are not renewed remotely; uncertain submissions never trigger fallback or resend.
• Finite skill metadata support for existing profiles plus the reviewed proposed skill 0.3.0/min0.1.0/full0.4.0/probe-help tuple. Runtime publication does not publish, install or update a skill; the existing published skill pin remains unchanged.

Reliability and safety

Prepared Claude/inactive Codex targets retain private continuity bindings. The sender journal protects its message-binding digest with AES-256-GCM and a separate private key; lost/changed/untrusted history never permits automatic recovery or replay. Native queue mechanics check the actual process build, executable identity, deadline and opened SQLite device/inode after the durable fence/final owner check. Literal message-file -, concurrent-wait SIGINT and owned-process cleanup regressions are covered.

Limits

Linux/Windows native observation, Windows private handoff storage and automatic voluntary receipt producer/collector remain follow-ups #130–#132. Required unsupported evidence refuses before submission. Queueing, text replies, turn completion and queue deletion never manufacture ACK. This is not receiver deduplication or a general exactly-once guarantee. Side Session/steering experiments are excluded.

Install or update

npm view session-peer@0.4.0 version dist.integrity
npm install --global --ignore-scripts session-peer@0.4.0
session-peer --version

Expected: session-peer 0.4.0 (typescript). Use the existing package manager and align both SSH endpoints to exactly 0.4.0. Python, remote runtime and separately managed skill updates remain independent.

Publication evidence

Source: dde3923efe116f87f38b1639b29b889d2b832e44.
Actions: https://github.com/abruption/session-peer-ts/actions/runs/39077096491
Tarball SHA-256: 84adc8b50ef8f03a2c2170e3c36a97b573f28a6bcbeb7dbc965e16c3b37a57c9.
Integrity: sha512-mMNJ118atoflhpFTkf2+DtO7MRf7FQnPK3lKWbq/vd8Xvb5DsjUtAgydIBOcd3Xj9BCYGqM50aFhzUr4dDGHSw==.

Public latest=0.4.0 and unchanged preview were verified. Reviewed, fresh merged-source, retained Actions, staged and public tarballs are byte-identical. Registry signature audit, Sigstore signature/certificate/transparency verification with the GitHub workflow identity/issuer policy, and source/subject/run binding checks passed. Isolated install/version/list/uninstall passed. The archive contains 71 allowlisted files; all 18 packaged Markdown files match source bytes. These packaging/provenance checks do not qualify additional native delivery or ACK platforms. Detailed scope and dated native evidence are in PARITY.md and VALIDATION.md.

The fresh Trusted Publisher mapping was checked as stage-only. The user explicitly skipped the separate web package publish-2FA policy read; it was not freshly audited. Actual GitHub environment and final npm approvals were completed.

Contributors

@abruption

Changes since v0.3.6