session-peer v1.4.0

v1.4.0 release preparation

Prepared on 2026-11-02 against published v1.3.3. At this dated checkpoint, v1.4.0 is an unpublished source candidate. The integrated base is f290973962c63548f24153eeee12a8e3666fd043, before version preparation; it is not the final release commit. This preparation authorizes no merge, tag, draft, workflow dispatch, publication or operational rollout.

Core Python 3.9, MCP Python 3.10+ and SDK requirement mcp>=1.30,<2 are unchanged.

Changes

• #356 / #361: add MCP list_destinations returning only policy-derived metadata, bounded to 64 aliases, 128 UTF-8 bytes per alias and 64 KiB per tool result, excluding the JSON-RPC envelope. This metadata query also works with policy version 1 and the default policy; it does not require policy version 2. It projects all configured policy entries without filtering by list/Send permission.
• #357 / #362: add single-target CLI --dry-run --explain-json delivery explanations. Raw SSH facts are captured before legacy output shaping; existing text and JSON output retain their contracts. MCP preflight_send requires the separate preflight capability in policy version 2; preflight never implicitly grants Send. Wake preflight also needs its separate wake capability, starts no model and reserves no wake budget.
• #358 / #363: add metadata-only diagnostics requiring the diagnostics capability in default mode. Active probing additionally requires diagnostics_probe, supports Mac/Linux only, and limits execution to 3 agents and 20 seconds excluding cleanup, with each pipe and the result bounded to 64 KiB. Nonblocking readers handle escaped pipe holders; cancellation wins during cleanup.
• Selected doctor agent/home scopes the actual collection; shared skill scanning is skipped. An OK result means collection succeeded, not agent availability, DB attestation or a reverse probe.
• #359 / #364: add policy version 2 route presets with approved names and exact action routes. Complete both checks before any Native invocation: first the route, then its revision; actual send requires an explicit target and revision. One snapshot and its dp1 fingerprint are neither destination identity nor ACK. Existing list/send JSON remains unchanged; safe query paths do not fall back to repair. Presets remain limited to Mac/Linux local/SSH Claude Code and Codex routes; wake, URI, Antigravity, device, handoff and Windows support is not expanded.
• Release preparation also defensively rejects MCP preflight response-root fields from the ordinary native protocol (submitted, consumptionConfirmed, status, dryRun, queueId), which the fixed send.preflight schema does not contain. No normal production CLI counterexample, misrouting or security incident was observed; this guard adds no capability, protocol, ACK or permission. The internal MCP process helper now honors an explicitly supplied timeout while the default 130-second CLI_TIMEOUT behavior remains unchanged; this correction makes no claim of impact on current normal callers or of an outage.

Exact source and validation

The merged sources are #361 444959c08acadc85ec48722c03354a3905fac174, #362 e68f1c8f224f30701a9b69bb693f4e99055880ee, #363 7f85cb12cf6661db2facd5d74b2b31d7ee8514bd and #364 f290973962c63548f24153eeee12a8e3666fd043.

Integrated-base CI succeeded with 37 jobs, and CodeQL succeeded at the same base. This is integrated-source evidence, not validation of the preparation's final head or the final protected-main release source.

Independent skill compatibility

The existing compatibility copy and prospective SKILL.md support asset remain the independently published Python skill v0.4.1, from source 263b0c333d539dc4e885b16ae3369a26f33097d8: 27126 UTF-8 bytes, SHA-256 fdf5697c04f4a37194986622afb3a7966bb02631c128cf18a323e3fbe5ae90ed. Its minimum runtime 0.9.1, documented full coverage 1.3.2 and receiver codexBin floor 1.0.1 are unchanged. The support copy stays outside wheel/sdist.

A separate skill 0.5.0 proposal would retain minimum 0.9.1 and document full coverage 1.4.0 only after actual runtime publication and separate approval. A later snapshot PR must verify the exact skill tag, source and hash. An absent future tag does not block this runtime preparation; never relabel changed bytes as skill 0.4.1. This preparation does not publish or install that proposal.

Boundaries and release gates

These extensions add no new live Native/SSH, Windows 3.14 or free-threaded acceptance, ACK/deduplication/handoff guarantees, owning app-server support or support promotion. Unknown roles and unknown outcomes retain their limits; queued submission is not ACK, and uncertainty never authorizes automatic retry.

Review the exact current head, require successful current-head checks and final protected-main CI, and preserve every published v1.3.3 tag, asset and historical record. Freeze these publication-neutral dated notes. A separately authorized publication must verify all 7 frozen assets, including SHA256SUMS and release-provenance.json, against the exact tag/source and authenticated attestations, run dependency audits and fresh installation checks, and retain required human PyPI environment approval. Skipping the private PyPI login/binding recheck does not waive that approval.

Record actual GitHub and PyPI publication evidence separately before updating availability statements; do not announce a future publication. Python publication, global MCP environment upgrades, service changes, Node Control deployment and independently installed skills remain separately authorized operations.