Add live session binding and project-scoped identities

CHANGELOG.md

@@ -5,8 +5,44 @@ compatibility surface is defined in [docs/COMPATIBILITY.md](docs/COMPATIBILITY.m
 
 ## Unreleased
 
+## [1.3.0] - 2026-07-28
+
 ### Added
 
+- Project-qualified human addressing now uses the profile metadata seats
+  already register: `PROJECT.SEAT` deliberately crosses projects, while a bare
+  canonical name, display name, handle, or role resolves only among profiles
+  sharing the sender's project aliases. There is no global fallback.
+  `identities`, `profiles`, and `status` accept `--project`; mailbox inspection
+  accepts qualified addresses or a project filter; directory output includes
+  predictable qualified aliases. Canonical mailbox keys and project aliases
+  reserve dot as the single qualification boundary.
+- `agentpost wipe agent [NAME]`, `wipe project PROJECT`, and `wipe all` provide
+  clean AgentPost identity resets without touching source or bridge
+  repositories. Self-wipe is direct; every broader scope first returns the
+  exact sorted affected mailbox list and requires the same list through
+  `--confirm`. Wipe removes complete target mailboxes, bindings, workspace
+  references, adapter state, and group membership, refuses other active
+  consumers, and states that successful deletion is irreversible.
+- `agentpost attach MAILBOX` gives an already-running Codex thread an explicit,
+  expiring session identity without restarting, changing the workspace
+  default, mutating its parent environment, or touching the global plugin.
+  Compatible stable hooks and AgentPost CLI subprocesses select the attachment
+  at subsequent lifecycle boundaries. Output distinguishes `boundary-only`
+  catch-up from an existing managed `live-bridge`; attachment alone publishes
+  no presence and cannot wake an already-idle thread. Owner-only atomic state,
+  exact thread/hook evidence, workspace-seat reachability, ABI validation,
+  consumer-lease checks, expiry, and explicit-identity precedence all fail
+  closed.
+- Codex doctor reports an exact `codex-session-attachment` check separately
+  from aggregate mailbox hook-generation recovery. A working attached thread
+  is now visible as boundary-compatible even when historical session-start,
+  prompt, or stop observations still correctly require reload for full
+  generation parity.
+- Codex install negotiation now preserves a compatible newer stable-dispatch
+  plugin generation when an older runtime runs `join`, preventing an in-thread
+  replacement or downgrade. Ambiguous and incompatible changes retain the
+  terminal-only, all-sessions-closed replacement contract.
 - `agentpost upgrade` refreshes every bound adapter in one command and reports
   each binding as `current`, `upgraded`, `skipped`, or `failed`, naming which
   CLIs need a restart. Upgrading the Python package and refreshing plugin
@@ -26,6 +62,31 @@ compatibility surface is defined in [docs/COMPATIBILITY.md](docs/COMPATIBILITY.m
 
 ### Fixed
 
+- Codex doctor and `agentpost upgrade --dry-run` now compare the installed
+  plugin generation with the running package's expected generation. A fully
+  observed older cache no longer reports `CURRENT` merely because its own
+  historical hooks agree with it; the preview names the required
+  all-sessions-closed replacement before the real upgrade is attempted.
+- Safe wipe now opens the attachment directory without following symlinks,
+  requires owner-private directory and file state, and unlinks relative to a
+  held directory descriptor. A malicious `runtime/codex-sessions` link can no
+  longer make agent or all-scope cleanup remove JSON outside AgentPost.
+- Wipe liveness now fences the authoritative mailbox consumer locks through
+  detachment instead of trusting heartbeat-derived presence. This closes both
+  lease-before-heartbeat deletion and consumer-start races; even self-wipe
+  refuses an unmatched live lease.
+- Mailbox registration and the complete wipe transaction now share a root-level
+  namespace lock: target discovery, confirmation validation, consumer fencing,
+  and commit all observe one namespace state. Wipe also revalidates target
+  absence before commit. A same-name replacement cannot acquire a new consumer
+  inode while the original is staged. If an unsupported direct filesystem
+  collision prevents rollback, AgentPost preserves the original recovery stage
+  and reports its exact path instead of deleting it.
+- Ordinary Codex attachment lookup now revalidates the directory, hook event
+  and stable ABI, finite coherent 30-day lifetime, initialized mailbox, and
+  recorded-project reachability before selecting the attached seat.
+- Source distributions now include the public v1.3 specifications linked by
+  the README.
 - `agentpost reply MESSAGE_ID` with an inferred sender now answers from the
   seat that actually holds the letter, instead of always acting as the single
   workspace default. A runtime notified as an alternate seat sharing the
@@ -149,6 +210,7 @@ First stable release.
 - Published bootstrap commands and the default installer source are pinned to
   the versioned `v1.0.0` release tag.
 
+[1.3.0]: https://github.com/5000Stadia/agentpost/compare/v1.2.0...v1.3.0
 [1.2.0]: https://github.com/5000Stadia/agentpost/compare/v1.1.0...v1.2.0
 [1.1.0]: https://github.com/5000Stadia/agentpost/compare/v1.0.0...v1.1.0
 [1.0.0]: https://github.com/5000Stadia/agentpost/releases/tag/v1.0.0

IMPLEMENTATION_STATUS.md

@@ -1,18 +1,18 @@
 # AgentPost Implementation Status
 
-Last updated: 2026-07-12
+Last updated: 2026-07-28
 
 ## Current phase
 
 The prior-art gate selected an independent literal-filesystem semantic core.
 The measured agmsg comparison and live Claude/Codex evaluation are in
-`PRIOR_ART_EVALUATION.md`. AgentPost 1.2.0 is the current stable release, with its
+`PRIOR_ART_EVALUATION.md`. AgentPost 1.3.0 is the current stable release, with its
 compatibility, security, and release contracts recorded in the repository.
 
-The local four-agent deployment now uses AgentPost as its sole actionable
-development-agent channel. Claude projects K/PB/C have the project-scoped
-`agentpost@agentpost-local` plugin generation 0.0.7; Cx uses Codex plugin
-generation `0.0.5+codex.20260712082137`, and the Python package is at 1.2.0.
+The local four-agent deployment uses AgentPost as its sole actionable
+development-agent channel. The 1.3.0 release packages Claude plugin generation
+0.0.7, Codex plugin generation `0.0.6+codex.20260728214546`, and Python package
+version 1.3.0.
 Plugin generations identify independently deployed adapter artifacts and do
 not replace the Python package's semantic version.
 Codex hook commands are stable across upgrades; a process that predates the
@@ -63,6 +63,10 @@ or the original data directories.
   executed-generation markers that never imply presence, `3/3` hook-trust
   verification, stale/unobserved/ambiguous generation diagnostics, and
   explicit approval, reinstall, and reload recovery.
+- No-restart Codex session attachment with explicit identity precedence,
+  owner-only expiring thread maps, stable-dispatch ABI negotiation, alternate
+  workspace-seat validation, boundary-only capability reporting, and
+  compatible-newer plugin preservation without downgrade.
 - Claude/Codex install, deterministic doctor, and mailbox-preserving uninstall
   commands.
 - Transactional adapter binding: failed setup records no false workspace
@@ -93,8 +97,13 @@ or the original data directories.
   delivery, ordered callback retry with visible exhaustion, async consumption,
   unread reconciliation, and non-claiming restart catch-up.
 - Human-facing channel addressing with an inspectable identity directory,
-  ambiguity-safe name/display/project/responsibility resolution, inferred
-  senders, natural named groups, and live-versus-queued delivery receipts.
+  project-filtered complete seat rosters, ambiguity-safe
+  name/display/project/responsibility resolution, inferred senders, natural
+  named groups, explicit `PROJECT.SEAT` cross-project references with no
+  global bare fallback, and live-versus-queued delivery receipts.
+- Guarded clean-start deletion for one mailbox, a complete registered project,
+  or all mailboxes. Broader scopes require an exact user-confirmed affected-box
+  list and remove only AgentPost-owned mailbox/routing state.
 - Sender-bound `AgentChannel` Python API with the same directory,
   resolve/message/question vocabulary as the CLI and direct availability as
   `AgentRuntime.channel`.
@@ -120,7 +129,7 @@ PYTHONPATH=src python3 -m unittest discover -s tests -v
 python3 -m compileall -q src tests
 ```
 
-The current suite contains 167 passing tests. Twenty consecutive pre-Antigravity
+The current suite contains 235 passing tests. Twenty consecutive pre-Antigravity
 full-suite runs passed after the concurrency and UTF-8 fixes. A clean Python
 virtual environment editable install and executable smoke test also passed.
 

MANIFEST.in

@@ -5,3 +5,4 @@ include SECURITY.md
 recursive-include docs *.md
 recursive-include integrations *.json *.md
 recursive-include scripts *.py *.sh
+recursive-include specs *.md