v0.109.0: native agent session continuity and grounded cross-agent handoff

[KAVentures]

Goal

Add an UltraContext-like cross-agent continuity layer without changing OpenWorkGraph's evidence-first/privacy-first architecture.

The canonical events table remains structural workflow evidence. Optional visible agent conversation is stored separately, is default-OFF, local-first, and has separate AI-read/Gateway permissions.

What this adds

Native agent session sensor

• Claude Code and Codex local session files can be tailed as an additional observation source.
• First enable is new-only: existing session files are primed to EOF rather than silently backfilled.
• Native structural observations feed the existing OWG agent-evidence schema.
• Richer SDK/hook/OTel evidence wins when the same event is already observed, so the native sensor is a fallback rather than a duplicate canonical source.
• Codex session/workspace metadata is carried forward from session_meta; Claude start boundaries are only asserted when actually observed.
• No-op in demo mode and when Observe/native-session observation is disabled.

Structural privacy boundary

Native records are never persisted wholesale. The parser deliberately drops:

• hidden/exposed reasoning or thinking;
• tool outputs;
• raw provider records;
• arbitrary complete tool arguments/content.

Tool input may be inspected transiently only to derive allowlisted structural facts such as safe/hashed file references, file types, git/gh operations, test status and line counts.

Optional visible-message continuity

A separate local store keeps visible user/assistant messages only when explicitly enabled.

• default OFF;
• high-confidence identity protection plus presentation redaction before persistence;
• fail-closed message write path;
• independent retention;
• independent AI-read toggle;
• delete-all control;
• content never enters canonical events.

Grounded handoff

/v1/agent-handoff and the compact MCP surface return a bounded prior-agent handoff combining, when authorized:

• optional visible prior-session messages;
• matching canonical structural execution evidence;
• opaque workspace/session provenance;
• nearby observed human-work context.

The response explicitly states that session text is untrusted context, structural evidence is canonical, and hidden reasoning/tool outputs/raw native records are not exposed.

Separate organization/Gateway permission

Session messages do not inherit allow_agent_events or existing evidence/context scopes.

• endpoint local policy: allow_gateway_session_messages, default false;
• organization policy: allow_agent_session_messages, default false;
• device write scope: agent-sessions:write;
• integration read scope: agent-sessions:read;
• endpoint restriction wins;
• existing enrolled devices with only evidence:write do not automatically gain transcript upload authority;
• dedicated sync cursor means enabling sharing later does not silently backfill older saved messages;
• messages observed while global Gateway sharing is paused are not later backfilled.

Dashboard

Agents includes Session continuity controls for:

• native structural session observation;
• visible message capture;
• connected-AI message reads;
• organization Gateway message sharing;
• retention;
• deleting saved messages.

Compatibility / non-regression invariants

• Existing Context / Observe / Brief semantics are unchanged.
• Existing hook, SDK and OTel adapters remain supported and preferred when richer evidence exists.
• Structural observation remains the default; message capture is never automatically enabled.
• Existing Gateway agent-event permission does not gain transcript access.
• No proprietary Claude/Codex session files are rewritten.
• Local AI access still starts OFF on every launch.
• No account or OpenWorkGraph-hosted storage is required.

Version / release

• Project, MCPB, Python SDK and TypeScript SDK metadata are 0.109.0.
• docs/CHANGELOG_V0109.md added.
• GitHub release workflow now includes the v0.109 release notes.
• CI-built macOS artifact identifies as OpenWorkGraph-macOS-v0.109.0.

Validation on exact head 1b4f0fa79f03a36f4b074109c1127ed566b05c2a

Full GitHub CI

• Ubuntu pytest: passed, including the repeat-suite-in-same-checkout guard;
• repository database-write guard: passed;
• Windows pytest: 955 passed, 2 skipped on the unchanged-head rerun;
• macOS pytest: passed;
• browser JavaScript syntax/tests + authenticated dashboard JS: passed;
• Gateway/PostgreSQL container integration: passed.

The first Windows attempt had one non-reproducible readiness-timeout failure in an existing secure-API startup test; rerunning the same job on the same head passed without code changes, confirming it as CI timing noise rather than a reproducible regression.

Release packaging

• macOS standalone ZIP: passed;
• Windows standalone ZIP: passed;
• Claude Desktop MCPB: passed;
• Python/Node agent SDK package: passed.

The branch is one clean commit directly on v0.108.0 main, mergeable with no stacked-PR dependency. main has not been modified by this work.