session-peer v1.3.0

session-peer v1.3.0

Source and publication status

Prepared on 2026-10-23 against published 1.2.1. This document records the release scope and verification gates; it does not announce package availability. Check GitHub Releases and PyPI for publication records.

The integrated source base is a0e7af032fd372334782cc3ac3d97b21c71dd797, before the version-preparation commit. The six feature PRs were merged in this order: #329, #330, #331, #332, #325, #328. Integrated CI and CodeQL passed for that base; they do not substitute for checks on the final release commit.

Included changes

• #323 / #325: text explanations for send --dry-run --explain, doctor --explain and handoff status --explain. They describe existing results and recorded evidence, including supported paired readiness context, without granting permission or proving consumption. An old receiver may leave context unknown. Stored receipt evidence is distinct from a new observation.
• #324 / #328: optional route presets and a separate recipient addressbook for local/SSH Claude Code and Codex on Mac/Linux. Actual address sends require the current --address-revision and exact --confirm-target; selection and writer checks are repeated. Revisions do not authenticate people or prove atomic native generation or storage identity. Windows, paired-device and Antigravity addressbook operations remain unsupported.
• #296 / #329: bounded POSIX handoff watch observes an existing intent. It does not create a submission, resend, collector or new receipt authority. It retains the experimental handoff scope and existing unsupported channels.
• #312 / #330: explicit trusted SSH configuration support. A trusted configuration can execute local SSH commands; this is an operator trust decision, not a sandbox. Existing target checks and uncertain-outcome handling remain.
• #212 / #331: expiring one-use pairing links and guided setup, using hidden terminal input and independent fingerprint confirmation. Both endpoints need the supported pairing protocol and existing Unix Relay requirements. Pairing does not replace target policy or native approvals; pending-offer cancellation does not revoke a completed pairing.
• #294 / #332: local, per-version automatic runtime-notice dismissal on Mac/Linux, with an explicit clear operation. Management is offline; explicit update checks and skill notices retain their existing behavior.

See the CLI reference, handoff guide and paired-device guide for exact combinations, platform limits and error behavior. The integrated changes also contain regression-test stabilization and an expired-room eligibility fix in the Python Relay (session_peer_relay/relay.py). Applying that fix to a running Relay requires an operator update and restart; no service deployment was performed. Passing reruns alone do not establish the cause of earlier unrelated failures.

Compatibility and remaining work

Python 3.9+ remains the core runtime floor; optional MCP requires Python 3.10+, and the Unix/WSL Relay receiver requires Python 3.11+. Core local/SSH use adds no third-party Python dependency. Ordinary submission results remain distinct from consumption, receipt ACK and task completion. Unknown outcomes never authorize automatic resend.

The GitHub release includes the compatibility SKILL.md asset from published companion 0.3.3, with minimum runtime 0.9.1 and full coverage 1.0.1. The newer companion 1.3 guidance is a separately reviewed document update; it is not included, installed or published by this runtime release. Plugin and TypeScript versions remain independent.

Side Session and steering research (#245/#247, Draft #246/#248) are assigned to Long-term and are not release features. The remaining native generation, handoff, storage and startup acceptance work (#180/#181/#268/#304/#306/#307) is not completed by this release. No general Codex ACK, delivery before a TUI's first input or Antigravity stable-support claim is added.

Release verification

Require current review and CI for the preparation PR, then successful CI and dependency audits on its exact protected-main commit. Verify generated standalone consistency, four-language documentation, package contents and fresh installations. Local integration and build results are rehearsal evidence, not the published artifacts or new live-agent/platform acceptance.

After the authorized tag and draft are prepared, wait for the preparation workflow and its attach-draft job to succeed. Verify all seven immutable assets (including SHA256SUMS and release-provenance.json) and authenticated attestations against the exact tag and commit before publication. Required human PyPI environment approval remains in effect. Record publication evidence separately; do not replace immutable assets to revise these frozen notes.

Package publication does not deploy Control/Relay services or update installed devices. Operational rollout and live acceptance remain separate.

Release source: 938630063b69bf6e0ae69d4b11e2095c30f289f4.