multi-agent-collaboration

Current release: 0.4.79

Protected terminal delivery recognizes the measured Claude 2.1.303 ultracode empty input frame. Its complete upper and lower rules must have the same width, and the body must be empty. Native identity and registry draft/dialog checks remain required. See 0.4.79.

The complete Word inventory uses current AX window indices and explicit attributes, retaining all metadata and UNKNOWN ownership. One exact original .73 PRE System Events -1728 reference failure can close its original restricted ticket through a source-bound read-only preview and original-actor apply. The historical cause remains unknown; no old run or legacy release is granted. See 0.4.74.

Word recovery documents may report their unsaved display name as a relative reference. The inventory preserves a unique matching document/window as unresolved, with filesystem_path=null, ownership=UNKNOWN and writable=false. The complete original metadata still participates in before/after checks.

The original 0.4.72 read-only PRE AppleEvent timeout now has a supported exact-SHA closeout for its original restricted ticket. It verifies the complete original source, fixed read-only script, failure, child and locks; the original actor alone may apply. See 0.4.73.

Word and Zotero process bindings use the installed bundle executable, including the lowercase zotero name, with unique PID and stable kernel/file identities. An exact original 0.4.70 pre-input failure can be closed through a read-only plan and original-actor-only apply. The original invocation and failure remain; no run is replayed and the legacy Word ticket is not released. See 0.4.72.

Domain work orders with an explicit completion_channel=ORDINARY_NOTICE now use the pinned scoped result planner without renaming their schema. Legacy scoped orders keep their default route; formal task, callback and nonce bindings remain refused. Planning sends no input and retains the issued complete controller. See 0.4.71.

The owned initial revision lane supports a separately approved tracked/accepted/rejected Word round trip and PDF while preserving an expired legacy ticket's quarantine.

Recognize structured Codex HTTP status aliases and explicit billing/authentication failures without changing provider configuration. A separately reviewed ordinary message with two verified zero-input attempts has one explicit recovery through its complete original controller. Preserve its original payload, endpoints, locks and history; input, uncertainty or a used recovery slot forbids another send. See 0.4.69 recovery.

Persist the exact idle-request marker before creation and sync its directory before input. Legacy recovery uses constant-memory, bounded discovery and a fresh directory/member stability check. Interrupted scans retain diagnostics and restart; large or changing legacy directories may still refuse safely. Preserve complete original controllers and issuer authority. See bounded request recovery.

Validate a prospective mailbox reply against exact original episode/body pins before publication, without sending, consuming or granting authority. New completion plans retain complete stdout/stderr and the original reconcile arguments. See reply preflight.

The restricted Word PDF lane permits new owned PDF work under an exact approved successor plan while preserving the original legacy quarantine and foreign UNKNOWN. It grants no citation refresh.

Read-only exact-pair coverage now reports the two original executor scopes, missing enrollment, expired authority and changed observations. Successor refusals can explain semantic changes from an exact original preview without authorizing stale apply. See pair diagnostics.

File-only sweeps retain the ten-second budget and give each selected executor a finite time slice. Recent future-due and finished rows follow overdue work; stale or malformed ordering hints cannot grant authority or skip live checks. A slice timeout continues with other rows and reports possibly committed work as incomplete rather than zero. See fair file sweeps.

Before generating a shared deliverable, read peer reviews at a separate work boundary and pin the adopted findings. Record late reviews as a new increment. When the sole reviewer is temporarily reassigned at WIP2, retain the original pending package pins and a concrete return condition. See task continuity.

Native target discovery uses the exact authenticated TTY inventory and a shared ten-second observation budget. Only read-only ps timeouts can retry, at most twice per command; stricter caller budgets still apply. UID filtering precedes kernel process reads, and native identity, fresh TTY and uniqueness checks remain. Reusing an inquiry with different proactive-hook authority is refused before state mutation. See bounded target observation.

Successor previews now survive ordinary polling while preserving all task, reply, reservation and pending-input changes in their reviewed semantic hash. Apply captures and archives the complete current raw preimages under the original locks and verifies them again before commit. See successor polling continuity.

Reply reminders now distinguish an unanswered inquiry from a body that still needs full reading and exact consumption. New scoped reviews use separate acceptance, progress and final paths and an executable ordinary result notice. cmux_prompt_reference.py prepare --text-file /absolute/body --sha256 SHA --marker UNIQUE_MARKER persists a new ordinary body and prints its short wire notice without sending. The complete 0.4.61 controller and historical issuer range stay under their original pins. See completion and reply status. Source verification, release, installation and real client collaboration remain separate evidence.

Send ready messages directly in both directions, including during work, Goal and compaction. Raw cmux send/send-key/paste is allowed. The optional bridge uses native Codex input when available and falls back to a single terminal paste and Enter only before any native input intent. Confirm a new user message containing the unique marker in the original receiver transcript. Never repaste an uncertain message; at most one recorded extra Enter may recover residual input after compaction ends. See direct delivery.

Bounded transcript scans preserve large-record progress and exact receipt evidence. Provider circuits keep automatic inquiries from feeding failed supervisor turns; file requests remain available. Successor inquiry enrollment requires the original executor, a pinned authorization and the exact reviewed plan. Durable work checkpoints report unique progress separately from parent acceptance. See 0.4.61 and task continuity.

Earlier release notes (historical behavior, not new-message admission rules)

Release 0.4.54 introduced communication between distinct existing terminal tabs in one pane, preserving authenticated identities and serialized input. See the 0.4.54 contract.

The 0.4.53 renderer: Match the measured Claude 2.1.303 reference renderer without relaxing exact content or duplicate-input checks. See the 0.4.53 contract.

The 0.4.52 release: Recognize authenticated Claude Code versioned native executables and settle handshake contract failures without duplicate input. Verify each upgraded client's actual process, startup settings, automatic hooks and real communication separately; see the 0.4.52 contract.

Automatic reply guidance permits ready messages during normal work and native Goal. Fresh task preflight verifies identity, handshake and validation without waiting for idle. Reviewed 0.4.50 file episodes preserve their original controller and authority. See the 0.4.51 release contract.

Bounded sweep history records scheduler timing, rotation and contention without changing file inquiries. The complete reviewed 0.4.49 file protocol keeps its original authority. See the 0.4.50 release contract.

Explicit inquiry re-enrollment by the original executor can preview past its previous stop while preserving formal reservations. The existing registration transaction clears that stop only after commit. Continuing reservation inquiries require explicit authorization; installed versions do not upgrade old episodes. The complete 0.4.48 file protocol remains supported under its original pins. See the 0.4.49 release contract.

Recognize the measured auto-compact percentage hint in a Claude elapsed footer without altering any composer bytes. Normal work and Goal remain compatible with prompt-ready delivery; actual compaction, unknown syntax and occupied drafts retain their checks. The reviewed 0.4.47 file protocol keeps its original authority. See the 0.4.48 release contract and evidence and handoffs.

Ready prompts can be sent in either direction during active work and native /goal turns. Fresh preflight skips the optional input-and-clear probe, so communication requires neither an idle turn nor a Goal pause. Real drafts, original-attempt deduplication and native receipt checks remain. See busy communication and the 0.4.46 release contract.

A failed original continuation can clear its own unsubmitted probe through scripts/recover_bridge_probe_clear.py when it sent the token but issued zero clear keys. Preview is static; apply belongs to the original supervisor, pins the archive and uses the complete original controller. Each key has a durable intent and fresh identity, native-log and composer checks. An interrupted or uncertain attempt cannot replay. Clearing submits no message; publishing bridge evidence additionally requires the original active reservation. See the 0.4.45 recovery contract.

Configuration checks close their bounded database snapshot before normalization. Unchanged profiles never acquire a writer lock; real changes use a short transaction that rolls back on any concurrent edit. Busy and budget outcomes are visible. One job watches the live hook files and CURRENT manifest, with profile imports discovered on its 60-second interval. See the 0.4.44 release contract.

The original bridge continuation remains limited to a never-typed token under its original supervisor, reservation and controller.

Reply consumption reports episode lock contention as EPISODE_BUSY JSON with exit code 2. It leaves the reply unconsumed and does not read episode state without the lock. Retry the same caller and reply SHA after the suggested one-second delay. The command does not retry automatically. See the 0.4.42 release contract.

Retain at least 10GB after installation and rollback costs; below 20GB, start proactive space management. Verified historical episodes retain file reservation inquiries only when their original enrollment explicitly authorized them. The scheduler uses the existing complete-release protocol checks and the same sweep verification cache; it grants no new capability or controller migration. Embedded and managed Codex identity also reject an intervening model CLI or unknown process. Only supported shell/rtk intermediates relay identity; the leaf resolver interpreter is allowed. See the 0.4.40 release contract.

An embedded Codex TUI can authenticate its own tools and native hooks through actual ancestry, matching native foreground selection, kernel process identity, UUIDs, TTY and stable rereads. Children cannot borrow a parent's identity. Original consumer proofs remain pinned; native *_id and historical *_uuid fields must agree when both are present. This does not create a native control socket or prove an existing client loaded the hooks. See the 0.4.39 release contract.

File reservation checks read their shared directory without loading the terminal harness and bridge. Authorization, STOP, ownership, reservation and reply checks remain live. Complete release verification is reused within one sweep, with every verified member and parent checked before reuse. Reviewed 0.4.37 episodes retain their original capability and controller pins. See the 0.4.38 release contract.

New submissions observe native reception for 30 seconds by default, with a finite 0–60 second option. Reconciliation defaults to one read-only observation and retains the original attempt, controller and RPC diagnostic. A timeout or aborted turn never authorizes another input.

Nonblocking hook context makes unconsumed replies, pending handshake work and callback settlement visible at actual tool boundaries. Exact reservations and RELEASE records preserve task ownership; callback settlement never dispatches the next task. Terminal reasks wait at least 60 seconds after the prior native confirmation. The reask scheduler uses Standard scheduling; the configuration guardian remains Background. Bounded discovery and measured Claude composer layouts preserve original drafts and pending evidence.

The reviewed file protocol includes the complete 0.4.37 release without granting historical issuers future authority. See 0.4.35 behavior and evidence boundaries and validation history. Source tests, installation, actual automatic hooks, full body reading and live native reception are separate checks.

Version 0.4.34 added late handshake reconciliation for a Claude native assistant record containing one exact ACK text block alongside structurally valid reasoning blocks. Extra text, tool blocks, malformed metadata and any ACK whitespace or nonce difference remain rejected; reasoning contents are never emitted in reconciliation results or archives. The original supervisor and complete original controller remain required. See late ACK reconciliation.

File scheduling retains the fully verified 0.4.33 v3 producer and v2 issuer, including its historical enrollment of the 0.4.32 controller. An older issuer cannot claim support for a future controller. No registration, consumption or transport authority is inferred from compatibility. For 0.4.34, the 40 ACK behavior tests passed locally and through the original 0.4.32 controller. Its final offline suite passed all 1,912 tests with no failures or errors; those historical results are not 0.4.35 validation.

The Claude footer parser recognizes the HUD's measured input/cache token breakdown below complete composer borders. It preserves draft text and continues to refuse ordinary input during compaction or reconnect. New Codex-bound input goes directly to the original native thread: active-turn steer or idle-turn start, with no composer or Tab queue. Uncertain requests are observed without resending. Workflow hooks remain nonblocking, and supervisor PostToolUse exposes authenticated file requests without sending or settling work. An explicitly enrolled Claude maintenance notice can expose its verified original queued body at a tool boundary; it never changes the original transport receipt. See the delivery contract and request lifecycle.

Version 0.4.33 also retains file scheduling for the fully verified 0.4.32 v3 producer and v2 issuer, including its original registrations of reviewed older controllers. Complete manifest and descriptor checks preserve the original controller and pending evidence; consumption remains executor-owned. It also provides original-supervisor ACK reconciliation for a handshake rejected after pasting without submission. Exact native ACK proof and the original controller remain required; see late ACK reconciliation. The 35 ACK behavior tests pass locally and through the original 0.4.32 controller; the final combined offline suite passed 1,906 tests with zero failures or errors.

Version 0.4.32 adds CURRENT's reviewed cross-release v2 file interpreter, recoverable registration transactions and explicit registration of an existing episode using its original enrollment SHA. The file scheduler preserves original controllers, UNKNOWN and pending evidence without loading old release code or sending input. Formal reservations pause same-supervisor inquiries; a valid newer reservation by the legitimate new supervisor ends the old supervisor's inquiry, even for an unsupported old producer. Only exact RELEASE clears a same-supervisor pause. That pause blocks new requests while retaining discovery of an already-bound reply; only the original authenticated executor and its original controller may consume it. Explicit start --file-only rejects transcript channels. This version also fixes a single-quoted ; Codex alone launch false positive while retaining checks on executable shell code. A separate explicit zero-input recovery entrypoint defaults to a read-only history plan; applying it pins the complete history SHA and appends one attempt through the original controller only when every earlier attempt proves no input. See SKILL.md for the exact evidence and readiness checks. Its full offline suite passed 1,885 tests with zero failures or errors. Installation and active-client adoption need their own evidence. See the cross-release file contract.

The bounded handshake observer preserves the original timeout and send attempt while reporting a late ACK without input. Validate registration, real scheduler execution, automatic hooks, full body reading and two real continuing rounds separately; offline tests and file ticks do not establish those live outcomes.

Caller discovery now distinguishes a validated optional foreground file from an earlier use of the same PID. It preserves current-process, required-observer and unique-client checks; it does not rewrite old records or select their threads. See PID reuse.

Multi-Agent Collaboration

New and successor Codex supervisors use their active native foreground thread. Caller discovery failure cannot lock ordinary tools or Stop; task evidence stays intact and terminal input still verifies both endpoints. See recovery without a session lock.

Evidence-bound collaboration for Codex and Claude Code in macOS cmux. 中文：复用完整上下文会话，明确分工，以真实报告和主动 callback 完成协作； 压缩故障及时干预，不以重开会话、假 ACK 或反复轮询代替恢复。

New messages use bounded single-line notices for pinned bodies; formal packs and callbacks retain their dedicated task-bound routes. Native RPC acceptance, Enter or Tab only requests submission. Reception requires the unique marker in a new user message of the bound receiver's native journal. See the delivery contract.

When present, the Codex control socket must authenticate as the current user and expose the exact loaded receiver thread. If it is unavailable before input, use terminal fallback. After an input intent, reconcile the original record and never change transport or repaste. Claude sends directly without an idle or composer gate. Old attempts retain their original controller and contract.

Install

Requirements: Python 3.10+, macOS, cmux, and existing CLI agent sessions. No provider credentials or agent subscriptions are included.

git clone https://github.com/lzhs1995/multi-agent-collaboration.git
cd multi-agent-collaboration
git checkout main
python3 scripts/manage_install.py install
python3 scripts/manage_install.py install --apply
python3 scripts/manage_install.py doctor

Install defaults to dry-run. It links this checkout into both clients' skill directories and merges only this project's hooks. Existing foreign skill directories are refused, never overwritten. Keep the checkout at its installed path. For a live shared installation, stage a complete immutable release and coordinate the upgrade with an installation lock, compare-and-swap checks and rollback snapshots. The basic installer is not a transaction spanning the whole installation. Preserve in-flight attempts under their original controller; independent authorized work need not wait. Verify active-client adoption separately, and never replace an agent session to upgrade its configuration.

python3 scripts/manage_install.py uninstall --apply

Uninstall removes only entries and links owned by this checkout. JSON backups remain beside the original configs and may contain credentials: keep them private. Other settings and hooks survive. Use --home /absolute/sandbox to test installation without touching real client configuration.

For explicitly authorized 60-second executor follow-ups, add --executor-reask to installation and doctor. To preserve owned hooks across cc-switch changes, use the single configuration guardian with a complete immutable release and its pinned CURRENT manifest. It repairs hook registrations only; Markdown guidance does not itself register a hook, and configuration repair does not prove a running client has loaded it.

Use

Ask the supervisor to use $multi-agent-collaboration, then provide the objective and designated existing executor. Both agents must read SKILL.md. The harness binds their identity and task; scripts do not log in or start a replacement agent.

python3 scripts/mac_harness.py --help
python3 scripts/mac_harness.py preflight --task-id example-review \
  --artifact-root /absolute/path/to/example-review --executor-surface surface:7 --executor claude

Replace the example surface with a freshly verified binding. Do not paste task prompts manually: use the finalized task-pack and callback entrypoints described in SKILL.md. Public defaults preserve the current model and refuse unknown compose text. Machine-specific preferences belong in local task settings.

The next-task chain is callback → independent acceptance/exact disarm → prepare the next authorized pack → fresh live preflight → guarded dispatch. Explicit 60-second reasks are a fallback; file timers cannot wake an idle model. ANSWERED awaiting consumption does not authorize repeated dispatch or a replacement episode. Track accepted unique coverage, verified issue closure and actual stage latency p50/p95, with sample counts and pending observations; ask_count is only a diagnostic. Reply-detected-to-consumed time alone proves neither business idle time nor its cause. See dispatch cadence and metrics.

Verification And Boundaries

python3 scripts/test_all.py

Tests use isolated files and mocked agent surfaces, without sending live prompts. Offline coverage is not certification of every cmux/client version. doctor proves configured hooks can execute benign payloads; a real task still needs the current-session handshake and current-task guards. Linux is an offline-test target, not a live UI transport. There is no Windows/tmux or ACP adapter in this release.

See lessons, security, and version history. MIT; cmux, Codex and Claude remain separate products.