[P1] Make agent-handoffs trustworthy: validator repair, public/private split, lifecycle reconciliation, and dogfooding

[hummbl-dev]

Status

P1 REMEDIATION PROGRAM — PUBLIC-SAFE REPOSITORY WORK ONLY — NO DELETION OR MIGRATION OF LIVE OPERATIONAL HISTORY WITHOUT SEPARATE REVIEW

Audit verdict

agent-handoffs is useful as a durable human-readable handoff archive and has produced real downstream agent work, but it is not yet a trustworthy executable handoff protocol.

The repository currently combines two materially different roles:

1. a public candidate specification, schema, fixture, and example repository; and
2. a live HUMMBL operational dispatch and scheduled-ledger surface.

This issue owns the bounded repair needed to restore alignment between the declared public boundary, the executable validation claims, and actual operational use.

Confirmed critical defect: false-green validator

fixtures/conversation-work-session/validate.py states that it validates fixtures against:

schemas/conversation-work-session-handoff-profile-v0.1.json

It declares SCHEMA_PATH, but the current script:

• does not import or invoke a JSON Schema Draft 2020-12 validator;
• does not load or use SCHEMA_PATH;
• validates only a subset of semantic conditions;
• treats any invalid fixture containing _adv_expected_failure as passing even when no semantic rule detects the declared failure.

The published schema uses additionalProperties: false and does not define _adv_expected_failure, so the marker is itself schema-invalid. The current test harness therefore cannot substantiate the merged claim that all valid and adversarial fixtures passed schema and semantic validation.

Until repaired, all repository validation claims should be treated as:

UNVERIFIED_VALIDATOR

Confirmed boundary drift

The README and docs/v0.1-boundary.md define this repository as a public candidate namespace that must not contain private, internal, or secret operational content.

The issue tracker is now also carrying live operational material, including current work queues, operator/device state, security and authority holds, collision keys, and internal fleet coordination.

This is a repository-contract mismatch even where no credential or secret has been exposed.

Confirmed lifecycle drift

Examples requiring reconciliation include:

• 72-hour scheduled-task validation campaign — 15-task operating lattice #13: the bounded validation window ended and [STANDING LEDGER] Agent Todo Queue — scheduled pickup packets #12 states the campaign is completed, but 72-hour scheduled-task validation campaign — 15-task operating lattice #13 remains open with an ACTIVE issue-body status;
• Conversation/work-session handoff profile v0.1 — resumable context without authority leakage #9: PR spec: conversation/work-session handoff profile v0.1 (#9) #10 merged the additive profile, compatibility decision, schema, fixtures, and validator, while later triage still recommended implementing those completed artifacts;
• Belief-Aware Agent Handoffs v0.1 — state, dissent, authority, and uncertainty transfer #8: PR docs: belief-aware agent handoffs v0.1 (#8) #11 merged the design document while its execution criteria remain open;
• [MOBILE HANDOFF] Operator offline — 2026-07-26 evening fleet support queue #14: some work packages produced useful receipts, but the requested final return packet and terminal issue disposition are absent;
• [HANDOFF] Frontier Lab Upstream Issue Program — validate Google Antigravity next #15: the handoff is issued but has no receiver claim, acknowledgment, progress, expiry, or closeout receipt.

Objective

Make the repository trustworthy enough that a real handoff can move through:

DRAFT -> ISSUED -> CLAIMED -> IN_PROGRESS -> COMPLETED|BLOCKED|REJECTED|EXPIRED|SUPERSEDED

with machine-verifiable structure, explicit authority, public/private safety, receiver acknowledgment, and reliable closeout evidence.

Workstream A — repair validation trust first

Required implementation

1. Add actual Draft 2020-12 schema validation for every fixture.
2. Make the validator fail closed when the schema or validation dependency is missing.
3. Move expected-failure metadata out of the fixture object into a sidecar manifest or test code.
4. Require each invalid fixture to fail for its declared reason.
5. Fail when an invalid fixture is rejected only for an unrelated reason.
6. Add tests proving:
   • missing required fields fail;
   • unknown properties fail;
   • invalid enum values fail;
   • malformed date/time values fail;
   • invalid fixtures cannot self-attest their own success;
   • valid fixtures pass both schema and semantic validation.
7. Add cross-record tests for:
   • duplicate handoff IDs;
   • supersession integrity;
   • receiver acknowledgment binding;
   • expiry behavior;
   • stale source-state fingerprints.
8. Preserve exact commands, dependency versions, fixture counts, expected failures, actual failures, and exit codes.

Validator acceptance criteria

• SCHEMA_PATH is actually loaded and used.
• Every valid fixture passes Draft 2020-12 validation and semantic checks.
• Every invalid fixture fails for one or more explicitly asserted reasons.
• _adv_expected_failure is not accepted as proof of failure detection.
• A malformed or schema-incompatible fixture cannot receive a green result.
• The validator returns nonzero on any unexpected pass or unexpected failure.
• Validation results identify exact fixture, failing rule/path, and expected disposition.
• A non-author review verifies the repaired harness.

Workstream B — restore the public/private boundary

Required decision

Keep this repository public and narrow it to:

• public-safe schemas;
• validators;
• fixtures;
• templates;
• prior art;
• sanitized examples;
• compatibility profiles;
• public-safe conformance receipts.

Route live internal operational payloads to an existing private operations or coordination surface. Do not create a new repository unless existing private surfaces are explicitly found unsuitable.

Required work

1. Inventory every open/closed issue and comment by privacy class:
   • PUBLIC_SAFE
   • INTERNAL_OPERATIONAL
   • PRIVATE_OR_SENSITIVE
   • UNKNOWN_REVIEW_REQUIRED
2. Identify repository-contract violations without assuming that every internal detail requires deletion.
3. Propose the authoritative private destination and routing rule for future live handoffs.
4. Preserve public-safe summary/index links where useful.
5. Use append-only correction, supersession, or migration receipts where historical removal would destroy evidence.
6. Update README, boundary documentation, issue templates, and contributor guidance so the split is mechanically clear.

Boundary acceptance criteria

• New internal operational handoffs are no longer created in this public repository.
• Future public issues use a validated minimal-disclosure profile.
• Existing operational issues have explicit privacy dispositions and migration/retention decisions.
• No private payload is copied to a new public artifact during remediation.
• The chosen private destination already exists or receives a separately reviewed justification.

Workstream C — reconcile lifecycle state

Produce an evidence-backed disposition for every currently open issue.

Minimum required reconciliation:

• Belief-Aware Agent Handoffs v0.1 — state, dissent, authority, and uncertainty transfer #8 distinguishes merged specification work from missing executable schema/validator/fixture work.
• Conversation/work-session handoff profile v0.1 — resumable context without authority leakage #9 records what PR spec: conversation/work-session handoff profile v0.1 (#9) #10 completed and narrows remaining work to proven residual gaps, including a real-session resume test.
• [STANDING LEDGER] Agent Todo Queue — scheduled pickup packets #12 remains a standing ledger only if a current-state reduction strategy is adopted.
• 72-hour scheduled-task validation campaign — 15-task operating lattice #13 receives a final campaign disposition and is closed or explicitly superseded.
• [MOBILE HANDOFF] Operator offline — 2026-07-26 evening fleet support queue #14 receives a partial closeout, residual-work routing, and terminal status.
• [HANDOFF] Frontier Lab Upstream Issue Program — validate Google Antigravity next #15 receives a receiver claim or expires without being represented as active execution.

Do not close an issue merely because a PR merged. Bind each disposition to the actual acceptance evidence.

Workstream D — create one operational handoff profile and dogfood it

Create one validated public-safe issue template or generated packet containing at least:

schema_version:
handoff_id:
workstream_id:
profile:
status:
created_at:
expires_at:
sender:
receiver_binding:
evidence_cutoff:
source_artifacts: []
verified_state: []
unverified_state: []
objective:
first_next_action:
allowed_actions: []
forbidden_actions: []
authority_granted: []
authority_withheld: []
privacy_class:
claim_required: true
closeout_required: true
supersedes:

Human-readable prose may accompany the packet but must not replace it.

Required lifecycle receipts

handoff_claim:
  handoff_id:
  packet_version:
  claimed_at:
  claimant:
  authority_basis:
  accepted_scope: []
  rejected_scope: []
  collision_keys_locked: []

handoff_closeout:
  handoff_id:
  packet_version:
  closed_at:
  outcome:
  confirmed_artifacts: []
  validation_evidence: []
  residual_work: []
  prohibited_actions_violations: []

Dogfood test

Run one complete public-safe handoff through:

1. packet generation;
2. schema and semantic validation;
3. issue or packet publication;
4. exact receiver claim;
5. bounded execution;
6. closeout receipt;
7. supersession or terminal closure;
8. independent audit that another agent can reconstruct the full state without replaying the originating conversation.

Workstream E — make the Todo ledger queryable

#12 may remain append-only as an event source, but it must not be the only current-state representation.

Design a deterministic reducer or bounded manual equivalent that produces a small current-state artifact such as:

state/current-queue.json
state/current-queue.md

It must preserve:

• last processed checkpoint/comment;
• current set and Todo status;
• claims and claimant binding;
• expiry and supersession;
• source-state invalidators;
• collisions;
• completion evidence;
• measurement gaps.

Do not silently rewrite the append-only event history.

Sequencing

1. Validator repair and independent verification
2. Public/private routing decision
3. Issue lifecycle reconciliation
4. Operational template and one end-to-end dogfood test
5. Current-state reducer for [STANDING LEDGER] Agent Todo Queue — scheduled pickup packets #12

No operational profile should be promoted as trustworthy before Workstream A passes.

Non-goals and prohibited actions

• Do not claim this repository is a universal handoff standard.
• Do not canonize new HUMMBL/BaseN/Ownward terms through this repair.
• Do not expose internal/private operational payloads while documenting the boundary defect.
• Do not delete issue/comment history without a separate, evidence-backed privacy decision.
• Do not create a new repository by default.
• Do not treat assignee presence as receiver acceptance.
• Do not treat issue creation as successful pickup.
• Do not use GitHub-hosted Actions minutes.
• Do not merge validator repairs solely because the existing false-green harness reports success.

Program acceptance criteria

• Validator claims are trustworthy and independently reviewed.
• The public repository and private operational handoff responsibilities are explicitly separated.
• Every open issue has a current, evidence-backed lifecycle disposition.
• One real handoff completes the full issue-to-claim-to-closeout lifecycle using the validated profile.
• The standing Todo ledger has a deterministic current-state view.
• Handoff creation, assignment, receiver acceptance, execution, and completion are separate observable events.
• Documentation and actual repository use no longer contradict each other.

Duplicate check

Searched open repository issues for:

• validator schema privacy boundary lifecycle operational template remediation
• validator repair and schema validation
• public/private handoff split
• lifecycle reconciliation

No existing issue owns this combined remediation scope. #8, #9, #12, #13, #14, and #15 are affected surfaces, not adequate umbrella owners.

Creation receipt

receipt:
  created_at: 2026-07-27
  source: operator-approved repository audit
  repository: hummbl-dev/agent-handoffs
  priority: P1
  duplicate_search: no_adequate_owner_found
  write_scope: create_one_remediation_issue
  github_writes: 1
  workflows_dispatched: 0
  hosted_actions_minutes_authorized: false