tmux-amq/workplans/TAMQ-WP-0010-experimental-pushy-delivery.md

id	type	title	domain	repo	status	owner	topic_slug	planning_priority	planning_order	created	updated	state_hub_workstream_id
TAMQ-WP-0010	workplan	Experimental pushy input delivery mode	communication	tmux-amq	finished	codex	coulomb-social	P0	15	2026-08-24	2026-08-24	6a6ec6f1-c704-5543-8879-6f6f7a09699c

Experimental pushy input delivery mode

Add an explicit, experimental mode that submits routed messages to the target pane's input for interactive coding agents that manage queued user prompts.

Required operator contract

tamq --mode pushy REPO... opts the whole managed endpoint into pushy delivery. The default remains --mode output; --mode inbox retains durable inbox-only behavior, and --no-display remains a compatibility alias for inbox mode.

Pushy delivery injects exactly one sanitized, single-line comment of the form #sender: body [message-id] and then one Enter key. This is deliberately safe as a no-op when an ordinary shell has an empty prompt, while coding-agent TUIs can receive it as submitted user input. The message becomes injected after tmux accepts both operations. Pushy mode may append to input already being edited and is therefore experimental and explicitly opt-in.

Add explicit endpoint modes

id: TAMQ-WP-0010-T01
status: done
priority: high
state_hub_task_id: "ce704aaf-faf6-58d5-8a34-0e0a3c12f472"

Add --mode output|inbox|pushy, retain compatible --no-display behavior, reject conflicting mode flags, register the selected endpoint mode, expose a pushy service capability, and report the selected mode in startup status.

Submit safely framed input

id: TAMQ-WP-0010-T02
status: done
priority: high
state_hub_task_id: "6b03d6fa-78e5-5a72-ad4c-65a035fb16ab"

Sanitize all controls and collapse multiline messages into escaped text. Use one checked tmux command list to send the literal comment and a distinct Enter operation. Do not reuse the terminal-output path, and mark the durable record injected only after tmux accepts both operations.

Prove and document the experiment

id: TAMQ-WP-0010-T03
status: done
priority: high
state_hub_task_id: "3957a42a-6151-5db2-af47-283789687eac"

Cover CLI conflicts and capability restart, store validation, exact framing, one-time service delivery, and real tmux input submission. Update help, README, and SCOPE with the risk boundary; run full checks, install, and exercise a controlled live pushy session without altering user messages.

Completion evidence

• make check: 117 tests passed, including a real isolated tmux shell proving one submitted comment, one Enter, one durable transition to injected, and no repeat delivery.
• Coverage: 77% overall; control handling is 86%, terminal framing is 85%, and the service is 77%.
• make install: installed tmux-amq==0.1.0; --mode pushy forced a restart of the older broker through the new pushy_input capability requirement.
• Live flex-auth to audit-core: WP0010-live-smoke appeared as submitted shell input with its sender and message id, was treated as a comment, and the record reached injected. Only that controlled record was acknowledged. The live endpoint was restored to --mode output; user messages were not modified.
• Bounded retry and acknowledgement-policy residuals remain owned by TAMQ-WP-0003; this workplan creates no additional residual record.