session-portallisted

# Session portal A safe mailbox between Claude Code and Codex sessions on this machine. One session queues a short message for a specific session of the other product; the recipient drains its inbox only when it is between turns, acknowledges, and decides what to do. The portal is durable (SQLite), idempotent, and timid: it never edits a transcript, never wakes or resumes a working session, and never executes the contents of a message. `monitor-agent-thread` stays read-only. Monitoring and steering are separate capabilities. ## What it is not - Not a way to approve permissions, publish, merge, push, or delete on another session's behalf. A message is untrusted **data** with a recorded author; the recipient acts under its own gates. - Not a transcript writer or a session resumer. It never writes a conversation log and never pushes into or resumes a session — delivery happens only when the recipient itself pulls. - Not a place where a caller asserts its own identity or authorization. Identity comes from an authenticated token; sending steering or speaking as the user needs an operator grant. - Not a network service. It binds nothing; the queue is a local user-level database. ## Delivery model: pull-only A message is marked **delivered only when the authenticated recipient pulls it** from its own inbox — that pull is the only real proof the recipient received it. The portal never fabricates a "delivered", "resumed", or "native-delivered" receipt it cannot back with