Journey result: Assistant handoff context carry

Walked: 2026-05-29 by Claude (Opus 4.8) against commit bf12b0f7d8.
Reconciled: 2026-07-17 against the current customer shell, context sanitizer, assistant session engine, Iris bridge, persona/tool policy, client storage, and focused browser/real-HTTP suites. This review does not rerun the historical walker.
Verdict: partial — current coverage deeply proves selected cross-domain handoffs, memory disclosure, evidence inspection, persona restrictions, tool- grant policy, storage scope, and honest degradation. The BFF assistant engine still holds sessions in process memory, and the sampled routes do not amount to universal cross-surface or restart continuity.
Historical runner: /tmp/claude-oshun-lt-2-walkthrough/walk.mjs assistant-handoff-context-carry. The temporary path remains provenance only; the repository suites below are the portable evidence.

Result at a glance#

Evidence lane	Current result	Authority limit
Shell context handoff	Real Tara→Veritas, Library, Explore, Search, Profile, and Nisaba launches with sanitized artifact/entity/selection context	Representative routes, not every surface
Assistant session API	Authenticated create/message/list/delete, ownership gates, turn count, continuity envelope, and not-entitled fallback	Engine sessions are process-local
Iris memory	Consent-gated profile/notebook recall, visible `Remembered context`, memory-off path, and crisis suppression	Memory durability does not persist sessions
Persona and tool policy	Customer/admin candidates, restricted persona no-op, audit row, and domain-scoped grant lists	Grant presence is not every tool's execution
Grounding	Live Veritas response carries sources/citations; inspection overlay reads source and support count	Bounded to the exercised grounded route
Browser persistence	Dock mode in localStorage; transcript/context in tab-scoped sessionStorage; reload and second-tab behavior proven	No cross-device transcript continuity

Evidence map#

The handoff is sanitized before session creation. Browser state and server state have deliberately different lifetimes; Iris recall can survive as memory without making the active assistant session restart-durable.

flowchart LR A[Shell route and selected context] --> B[Context sanitizer] B -->|safe artifact or null| C[BFF assistant session] B -->|wrong shell or PII| D[Drop or redact] C --> E[Process-local assistant engine] E --> F[Iris consent-gated recall] E --> G[Persona and tool policy] E --> H[Grounded response] H --> I[Transcript and disclosure UI] I --> J[sessionStorage: tab transcript] I --> K[localStorage: dock mode] E -. restart loses active session .-> L[Durable session store absent]

Proven observations#

Historical walk and later repair#

The 2026-05-29 walker proved /tara, /explore, /messages, and the newly added assistant-context endpoint rendered/responded. It did not exercise full cross-surface carry.
A later hydration repair removed stale server/client profile snapshots. That useful rendering fix is historical provenance, not current continuity proof.

Current browser continuity#

The browser starts on Tara from Explore, navigates through the real Veritas shortcut, opens the assistant, and preserves origin=explore&stack=tara in the session payload and return-thread/return-anchor links.
A Nisaba notebook launch writes consented profile and notebook memories, carries the notebook id in the handoff, and renders the real Remembered context: profile/notebook recall with Memory: profile.
Search supplies a wrong-shell entity. The sanitizer sends entity: null, records entity-shell-mismatch, and renders the safe removal chip without exposing the rejected label. Selected email, phone, and SSN-shaped strings are redacted before the live session-create request.
A Veritas turn returns a grounding envelope. “Inspect evidence” opens the shared overlay with the named source, support count, citations, and source- directory action.

Current policy, API, and storage evidence#

Real HTTP covers session create, two messages with turn count 1→2, list read-back, ownership-safe errors, delete, and the no-domain-access branch.
Profile memory can be turned off through real preferences; the create payload, response, handoff chip, disclosure, transcript, and first turn all remain memoryScope='off'.
Persona recommendations enforce customer/admin shell and domain scope. A restricted admin persona is disabled in the customer shell, force activation is a no-op, and an applied customer handoff emits a visible audit row.
Tool grants vary by domain: Profile exposes navigation, Library adds save, and Tara exposes domain action. The result proves policy projection, not every downstream tool implementation.
Dock expanded/collapsed/closed mode persists in localStorage. The transcript persists across same-tab reload in sessionStorage and is absent in a second tab, which receives only the dock mode.
A real operator crisis frame suppresses ordinary assistant synthesis: no cards or actions are returned and the turn count does not advance.

Boundaries and gaps#

Browser continuity is not restart durability. AssistantEngine stores its sessions in a Map, and the BFF keeps one module-level engine. A process restart discards the active session/list even when separate Iris memory rows remain available.
Storage scopes are intentionally different. Dock mode crosses tabs via localStorage; transcript/context is sessionStorage and tab-scoped. Neither is cross-device continuity.
Representative routes are not universal coverage. Deep tests exercise the named shell routes and handoff variants, not every customer, studio, admin, mobile, and degraded surface that can host assistant chrome.
Grant projection is not tool completion. The UI and policy expose domain- appropriate grant names. This result does not prove every granted tool's authorization, side effect, compensation, and audit lifecycle.
Grounding is route-bounded. The live Veritas turn and inspection overlay are source-backed. Other domains may use different adapters and do not inherit this exact evidence automatically.
External delivery and voice quality are outside this record. The result does not certify provider-backed voice, avatar behavior, accessibility audio, or an outbound assistant channel.

Re-run evidence#

The portable focused suites are:

bash

PW_BROWSER_CHANNEL=chrome pnpm exec playwright test \
  -c apps/oshun/web/playwright.config.ts \
  apps/oshun/web/e2e/assistant-continuity-journey.spec.ts \
  apps/oshun/web/e2e/assistant-handoff-deepening.spec.ts \
  apps/oshun/web/e2e/assistant-session-bff.spec.ts \
  apps/oshun/web/e2e/assistant-not-entitled-fallback.spec.ts \
  apps/oshun/web/e2e/shell-utility-dock.spec.ts \
  --workers=1

They require the real-development-infrastructure web/BFF harness. Source reconciliation alone must not be reported as a fresh cross-surface walk.

Source trail#

Cross-references#

Open questions#

Which durable, owner-scoped store should replace the process-local session map, and what is the restart/reconnect contract for a tab holding an old session id?
Which tool-grant policies have end-to-end execution, audit, rollback, and failure evidence rather than projection-only coverage?
What route matrix defines the minimum continuity contract across customer, studio, admin, mobile, offline, and entitlement-degraded surfaces?
How should cross-device continuation distinguish durable Iris memory from the private, tab-scoped transcript the user did not ask to synchronize?