[abruption]

Summary

Implements the #212 v1.3 candidate as a receiver-bound one-time link, without a broker, short numeric code, browser handler, hosted deployment or new listener. Existing Unix Python 3.11+ relay dependencies and receiving target policy remain required.

• device offer --peer-key … --direct|--relay … --show-link, offer-status, offer-cancel, and hidden device pair --link input. Existing invitation-file commands remain supported. Guided setup offers both methods.
• Both identities require explicit owner-terminal confirmation. Candidate receiver identity/routes are withheld until the independently obtained fingerprint matches; a final confirmation follows. Input is bounded and echo-disabled, including long links and Ctrl-C restoration. Creation atomically rechecks the confirmed client binding.
• The bounded session-peer://pair/v1#… envelope carries an existing invitation and intended current client certificate fingerprint. It does not establish an arbitrary stable principal. Rotated identities require the exact existing active anchor. Existing pinned TLS and private-key possession remain mandatory.
• Durable reservation ownership, expiry, cancellation and consumption are serialized under BEGIN IMMEDIATE. Links require pairing-offer-v1, exact invitation-bound commit and the authenticated raw TLS key. No legacy downgrade or paired-to-pending transition; cancellation affects only its owned pending trust.
• Exact public intent is saved before staging/networking. Cold expiry refuses without writes/network; saved-intent reconciliation can retrieve an already-consumed result, never prepare after expiry or undo revocation. A validated remote commit followed by a local fault never triggers another preparation; pending history remains available for the next explicit invocation. Receipt queries preserve operator-updated routes.
• Guided setup saves a public UUID before creation. Definitive refusal is retryable; uncertain/pruned history remains unknown. Explicit cancellation may stop local waiting without proving remote cancellation. Manual caught display failures also return only a public ID for inspection/cancellation, never the secret.
• Existing unambiguous live legacy reservations can resume. Provably expired pending state is retired without deleting anchors; ambiguous live state remains refused. Recovery-gated history is never expired, pruned or charged by these pairing operations; status is marked historical.
• Four-language CLI/setup, lifecycle, threat-model and secret-handling documentation; regenerate standalone parser. No native agent send, permission-policy expansion, dependency/version bump, package installation or operations change.

Protocol/threat-model proposal preceded implementation: #212 (comment)

Refs #212. No merge or publication is part of this PR.

Validation

• Final generated candidate: Python 3.13.7 with optional extras, development mode and ResourceWarning-as-error: 1,410 tests pass, 19 skipped. Generator and staged diff checks pass.
• Isolated Python 3.9.6 default environment with the repository's pinned test-only packaging dependency: full discovery before final relay-only refinements 1,101 pass, 41 skipped. The final optional-module skip and documentation checks are verified separately; relay support is not claimed for Python 3.9.
• Offline real loopback TLS and PTYs plus synthetic fixtures cover successful pairing; wrong key/principal; downgraded protocol; expiry during client connection and receiver validation; loss of prepare/commit replies; transient reconciliation; cancellation/commit and cross-connection reservation races; quotas/retention; legacy upgrade; revoked keys; exact-intent cap; current-route preservation; hidden input, confirmation ordering and public-ID-only failures. A real backup/restore fixture verifies all new tables remain recovery-gated and byte/counter unchanged after an eight-day clock advance.
• Two parallel noninteractive independent CLI rounds before push: Claude Code 2.1.308, confirmed claude-opus-5-5; Codex CLI 0.163.0, isolated default (actual model name not exposed). Each pair received identical frozen sanitized input, completed successfully, and had no tool/test/network authority. Input SHA-256: f431baa9c7f996b7c81a6ad551df5abb51933590f89158984bd880c2ffb2d7b9, b4933dd662a6e8f7953ad8f9f26995bdb854d011b4a6bdcb13023c08066b961e.
• Findings were source-checked, fixed and regression-tested. Narrow final fixes were then independently audited against the actual source by a separate read-only subagent: no blocker found. This is not a claim the CLI reviewers re-reviewed the final revision or ran any tests.

Explicit limits and compatibility decisions

• Local macOS/Linux fixtures, not real multi-machine/account/native-agent or hosted acceptance; no Windows pairing support is added.
• Creation: 5/minute, 8 active offers. Global preparation: 32/minute including legacy file pairing, 8/minute per offer. Full buckets do not extend their window or write repeatedly. Anonymous traffic can temporarily deny legitimate pairing; already-paired native requests do not use this bucket. This is bounded admission, not flood-resistance or availability proof.
• Receiver terminal receipts retain seven days, up to 1,024 offers. After pruning, exact historical receipt recovery is unavailable; no synthetic receipt or late-repair command is invented.
• Client exact intents have a deliberate 1,024-record cap with no automatic pruning or cleanup command. At capacity new link pairings fail closed; exact existing intents may still reconcile while receiver evidence exists. No silent history eviction or blind database reset is suggested.
• Wall-clock expiry assumes trustworthy endpoint clocks. Acceptance is checked immediately before trust mutation; durable fsync may finish later.
• Setup is a current-operation journal, not a permanent audit ledger. Missing history means unknown, not no effect. Stop-waiting does not cancel an earlier remote operation or revoke a paired peer.
• New link support needs both ends upgraded; file protocol remains supported, with documented ownership/expiry migration boundaries. No automatic native message resend, account-wide trust, consumption/ACK or exactly-once claim.

Translation quality review (2026-10-23)

At the user's request, Antigravity CLI 1.4.5 explicitly selected available gemini-3.8-flash-medium, medium effort, plan mode and sandbox with a four-minute limit. The task-local runner omitted permission-bypass flags and repository access. One fresh read-only review completed with exit 0 and structured output (190.462 seconds, no retry). Frozen evidence covered all 256 added/changed lines across eight English/Korean/Japanese/Simplified Chinese CLI reference/paired-device files at ad8b9b9, plus context; prompt SHA-256 1469e7cf2ef2a23769f311faad06ba6c7572ccc98157150ac7141530d65f2cba. The model selector is recorded; independent backend identity is not exposed by the normalized result.

Codex verified full source sentences and applied narrow translation corrections in six locale documents: failed guesses count toward limits; native CLI approval and agent-execution authority remain distinct; a missing-history local stop performs no remote-revocation operation; Korean native-message terminology no longer implies original-message identity. The model's overbroad OS-approval interpretation was rejected, and the text does not claim that unknown remote authority is currently valid, revoked or unexpired. English/style suggestions were not used to alter the contract. Runtime, English source, flags, code, links, numbers and versions are unchanged. Documentation tests: 65 OK; deterministic code/inline/link/digit preservation and diff checks pass.

This is static linguistic/semantic QA, not native, security, runtime or native-speaker field validation. Earlier CLI code-review and automatic review results remain scoped to their exact recorded source; no claim that they re-reviewed this documentation-only follow-up.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-23T01:16:08.306758Z	ad8b9b9	PR opened
🔒 Security Review	✅ Completed 2026-10-23T01:23:01.846401Z	ad8b9b9	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.