Handoffs are packets, not copy-paste
When a session ends, Zephr builds a Continuity Packet: a canonical, signed bundle of what the next tool needs. The format is not a JSON blob copied into chat. It is a versioned envelope with a manifest root, source authentication, destination binding, and one-time consumption — so the receiving agent can verify what it is about to import before it parses the content.
This matters because the naive version of cross-agent memory is 'paste the summary into the next tool'. That destroys provenance, loses review state, and lets a malicious or hallucinated summary enter the next session as fact.
Auth before parse
The receiving client verifies three things before reading the payload: the Ed25519 source signature proves who issued the packet; the one-time HMAC-SHA-256 destination binding proves the packet was minted for this destination; the recomputed manifest root proves the contents were not altered.
Only after all three checks pass does the client parse the enclosed beliefs. Auth-before-parse, not parse-then-check.
One-time consumption
Each capability is consumed exactly once through an atomic CAS ledger. A second attempt to use the same capability fails. A revoked source key yields refusal before parse. Revocation fails closed, not silently.
This prevents replay attacks and makes handoffs auditable. The consumption record, together with the source signature and destination binding, forms a complete chain of custody.
Cross-tool and cross-device
The same format carries beliefs across Claude Code, Cursor, and Codex, and across devices. v1.1 adds review state, scope proof, and revalidation anchors so an imported memory is as auditable as a local one. The destination runs guardrail validation — allowed-tool contracts, scope-proof verification, review-state rules — before import.
A mismatch does not silently downgrade. It produces a structured refusal or an annotated prose downgrade, honestly labelled. Untransferable tool state is not silently executed.