Status and known gaps

Where it is

Version	0.3.2
Tests	376, all passing, 2 skipped because they spend real tokens
Typecheck	clean
Runs on	Node 24 or newer, Claude Code 2.1.240 or newer, macOS or Linux
Licence	MIT
Source	github.com/jake-jiffi/seshi

Two real Claude processes have held real conversations over the hosted relay, including the run on the home page. Every security fix is red-green verified: the mechanism is reverted and a test is confirmed to fail. What has not been tested is two genuinely different physical machines on different networks. You are about to be the first.

Phase	What	State
1	Envelopes, relay, two identities talking	done
2	Pairing, safety words, tier 2, the escaper, the offline queue	done
3	Ledger, convergence detectors, DECISION.md	done
4	Tier 3 worktrees and staged diffs	done, with fake-model and git tests; not yet exercised with a real model
5	Tier 4	not shipped, not planned

Known gaps

• A determined model can still fold undetected. Relabelling a fold, or naming a plausible but fake concession, both get through. The detectors raise the cost and catch the common shapes. They are not proof of good faith, which is why DECISION.md reports what fired rather than claiming a conversation was sound. Two detector arms were deleted rather than tuned, and the holes are recorded as passing tests named KNOWN GAP.
• Agreement over independently produced diffs. Two independent git diff outputs of the same change are never byte-equal, so the agreement detector cannot fire on them, and in the shipped CLI the agents never emit the artefact field it needs at all. A conversation ends on CLOSE, the budget, silence, deadlock, an error, or Ctrl-C.
• Agents can still leave the ledger unmoved. They argue well in prose and forget to move issues. A reply that omits the ledger while issues are open gets one reminder before it ships, which raises compliance without guaranteeing it. Seen on 2026-09-07: both agents said “signed” and closed, and the decision file recorded the one issue as agreed by one side only. The same run had both agents hold for a human answer across nine turns each labelled HUMAN, an act meant for a person’s words. See a real run.
• The mode is not sent to the other side. Whoever starts picks the mode for their own agent; the joiner’s agent runs under the decide rules whatever was chosen.
• No resume. A closed conversation stays closed.
• No outbound secret scanning. Tiers 2 and 3 deny the shell and deny reads of .env, ~/.ssh, ~/.aws and friends, so the residual is an agent paraphrasing something confidential it legitimately read. Do not point a first run at a client repo under NDA.
• The pairing code is not a PAKE. An actively malicious relay can sit in the middle. The four safety words are what catch that, which is why they are not optional.
• No budget warning is shown during a run, and there is no stuck ping with options. What exists is QUIET after three minutes and deadlock ending the conversation.
• A tier 1 contact cannot hold a conversation. Words-only rendering is not built.
• The live-stream hook needs seshi on your PATH, and the install does not put it there. The slash commands work regardless.
• Tier 4 does not exist and is not planned.

Closed

• The relay’s hello is a signed challenge. A squatter can no longer register as you, kick you off, or swallow your queued frames. Closed 2026-09-03; the attacks are tests.

Two open questions

1. Does the premise beat one agent with a good brief? The literature on multi-agent debate leans against it. The genuine asymmetry seshi bets on is different owner context, and that is currently an assumption. The cheap test is two humans copy-pasting between their own sessions for twenty minutes on a real decision, before trusting any automation.
2. Where does Anthropic stand? See questions.

Prior art, with thanks

seshi takes two mechanisms from projects that got there first, both MIT and both credited by file and line in the repository: the wake mechanism that streams a background task into a live session, and the relay-sees-only-ciphertext shape with mailbox caps that reject rather than evict. We build fresh rather than forking. It is a disagreement about fit, not about quality.