feat: add readable duplex messaging

Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a03397-4d51-7fd1-8ff2-946eb22ea2bc

SCOPE.md

@@ -16,17 +16,19 @@ tamq does not choose or infer them.
 - Local SQLite message history, leases, endpoint registrations, delivery state,
   acknowledgements, replay, export, and bounded purging.
 - Managed neutral-shell tmux lifecycle and explicit initial commands.
-- Durable manual send/inbox/acknowledgement with per-window repository identity,
-  shell-native direct and latest-counterparty reply commands, comment-safe
-  display, a recipient-aware inline composer, and explicit pull-time filters.
+- Durable send/inbox/acknowledgement with per-window repository identity,
+  readable `To:`/`From:` framing, explicit operator/worker provenance, and
+  pull-time filters.
 - Sanitized one-time output notifications through target tmux pane PTYs, with
   inbox-only delivery as an explicit option and no foreground-process input.
-- Explicit experimental pushy delivery that submits a sanitized comment and
-  Enter to target pane input for known queue-capable interactive programs,
-  with `#repo:` routing observed through the PTY tap.
+- Explicit experimental pushy input placement and trigger submission for known
+  queue-capable interactive programs.
 - Explicit opt-in control-mode pane delivery and the full-duplex `tamq tap` PTY
   broker for integration experiments.
-- Exact `gita` repository validation and direct `@repo:`/`#repo:` routing.
+- Exact `gita` validation and direct start-of-line `To:repo:` routing from
+  operator input or normalized worker output.
+- Operator-only allowlisted `Cmd:` runtime changes and atomic, session-lifetime
+  per-window message/input/output line budgets.
 - Unix-socket operations for local clients and a future coordination-engine
   adapter.
 - Policy profiles, safety-gated retries, local diagnostics, tests, packaging,
@@ -55,40 +57,39 @@ transport.
 
 | Intent capability | State | Evidence and remaining gap |
 | --- | --- | --- |
-| Direct repository addressing | Implemented for local alpha | Exact `gita` validation, per-session `@repo`/`@repo:` shell commands, tapped `#repo:` agent-input routing, a bare `@` composer with latest-counterparty default and Tab recipient cycling, and long-form parsing are covered. |
+| Direct repository addressing | Implemented for local alpha | Exact `gita` validation and case-sensitive `To:repo: body` parsing are shared across operator input and worker output. Legacy `@/#` addressing and the composer are removed. |
 | Durable, inspectable local queue | Implemented | SQLite history, manual inbox, leases, endpoint records, inspect/history, JSONL export/replay, acknowledgement, age/size purge, and exact reflected-chain purge are present. |
 | Local socket service | Implemented | Peer-credential checks and structured ping/register/send/history/ack/endpoints/disconnect operations are tested. |
 | Neutral tmux session lifecycle | Implemented for local alpha | Repository-first startup opens untouched shells at exact gita paths, exports per-window identity, and runs no initial command unless `--command` is explicit. Stable reuse, service restart, and cleanup are covered by the installed-package test. |
 | Emergency local cleanup | Implemented for local alpha | `tamq cleanup` dry-runs by default; confirmed cleanup verifies ownership before stopping the broker or marked session, clears only transient DB state, removes configured runtime files/generated shims/owned stale tmux sockets, and preserves history. |
-| Safe manual messaging | Implemented for local alpha | Normal endpoints write one sanitized comment above a stable shell input row without injecting stdin; conservative fallback handles the first row and alternate screens. Messages remain pending until acknowledgement. Inbox-only manual mode is explicit with `--no-display`. |
-| Experimental pushy delivery | Explicit opt-in | `--mode pushy --command ...` observes outbound `#repo:`/`@repo:` lines and submits a non-routable `# from sender:` envelope plus Enter through a checked tmux command. Startup rejects stale framing capabilities, and the tap recognizes durable legacy delivery receipts as a feedback circuit breaker. It marks successful delivery `injected`, but cannot identify pane occupants or protect input already being edited. |
-| Full-duplex input observation | Explicit opt-in | `--tap --command ...` enables the PTY integration path. It is absent from neutral startup and remains covered for geometry, resize, raw mouse input, and lifecycle behavior. |
+| Safe output messaging | Implemented for local alpha | Normal endpoints write one sanitized `From:` line above a stable shell input row without injecting stdin; `/o` marks operator origin. Messages remain pending until acknowledgement. Inbox-only mode is explicit. |
+| Experimental pushy and trigger delivery | Explicit opt-in | Pushy places a non-routable `From:` line without Enter; trigger adds exactly one Enter. Both are capability-gated and mark accepted delivery `injected`, but cannot identify pane occupants or protect input already being edited. |
+| Full-duplex observation | Implemented for managed messaging | Every messaging-enabled new window runs its neutral shell or explicit command behind the PTY observer. It preserves geometry, resize, mouse input, and raw forwarding; normalizes worker output, deduplicates redraws, and fails closed on exact recent operator echoes. |
+| Runtime commands and generation budgets | Implemented for local alpha | Operator-only `Cmd:` changes mode or per-window limits and resets the current ledger. Defaults are 8 message, 1024 input, and 32768 output lines. Admission and counter increments are atomic and survive service/tap restarts in one session generation. |
 | Bounded retry behavior | Not enforced | Failed output or injection remains pending and becomes claimable after lease expiry, but no attempt counter or terminal failure state applies the configured cap. |
 | Acknowledgement policy | Partially implemented | Terminal output remains pending until explicit acknowledgement, while legacy pane injection becomes `injected`; the configured `delivery_ack_mode` does not yet govern both paths. |
 | Coordination-engine interoperability | Not implemented | The adapter contract and implementation remain in `TAMQ-WP-0002`. |
 
 ## Practical Usability
 
-The terminal-neutral alpha path was exercised successfully on 2026-08-24 with
-an isolated installed tool. Repository-first startup created two ordinary
-shells at exact gita paths without sending initial keystrokes. The test proved
-per-window repository identity, stable reuse, shell-native addressing,
-latest-counterparty replies, comment-safe target output above an unchanged
-partial input line and cursor, inbox/filter/ack exchange, zero target-input
-mutation in safe modes, service restart, endpoint disappearance, explicit
-initial-command startup, and cleanup. Isolated pushy-mode coverage additionally
-proves one `#repo:` route, one non-routable target submission, and no feedback
-message.
+The terminal-neutral alpha path is exercised with an isolated installed tool
+and real tmux/PTYs. Repository-first startup creates two observed ordinary
+shells at exact gita paths without selecting an agent. Tests prove per-window
+identity, stable reuse, operator and worker `To:` routing, exact `/o`
+attribution, echoed-input suppression, stable target output above unchanged
+partial input, inbox/filter/ack exchange, pushy placement, trigger submission,
+line-limit/reset behavior, service restart, explicit-command startup, and
+cleanup.
 
 Suitable today:
 
 - Local queue, history, export/replay, and diagnostic use.
 - Interactive local shell or explicitly commanded sessions over one or more
   gita-registered repositories.
-- Durable manual message exchange between managed repository windows, including
+- Durable message exchange between managed repository windows, including
   explicit pull-time loggers and filters.
-- Controlled experiments with pushy delivery to coding-agent interfaces known
-  to queue asynchronous user prompts.
+- Controlled experiments with pushy placement or trigger submission to
+  interfaces known to queue asynchronous prompts.
 - Developing and testing the future coordination-engine adapter against the
   local socket boundary.
 
@@ -102,13 +103,11 @@ Not yet suitable:
   and stronger process-supervision evidence.
 - Cross-host messaging or use as a general-purpose broker.
 
-The suite currently has 131 passing tests and 78% statement coverage. Coverage
-is strongest in durable storage and registry handling, and weakest in the PTY
-tap and CLI orchestration; PTY statement coverage increased from 23% to 33%,
-while subprocess behavior is primarily proven by the real-tmux test. The
-Forgejo CI job installs tmux and uv, runs the real-tmux and isolated
-installed-package session tests with a deterministic gita fixture, and retains
-CLI help/version smoke checks on Python 3.11.
+The suite currently has 133 passing tests. It includes atomic counter races,
+pseudo-terminal normalization, real tmux pushy/trigger behavior, operator-echo
+suppression, and an isolated installed-package workflow with deterministic gita
+fixtures. Forgejo CI installs tmux and uv and retains CLI help/version smoke
+checks on Python 3.11.
 
 ## Next Usability Gates