# ConnectOnion 1.9.3rc5 (release candidate)

## Install this preview

Stable remains 1.9.2. Install this release candidate by exact pin:

```bash
python -m pip install --upgrade 'connectonion==1.9.3rc5'
```

## Handoffs are end-to-end encrypted

`co handoff` used to store each handoff on the backend as readable JSON: the
report, every message the sender typed, the AI's replies, and the code that
picks it up. From this candidate the backend holds ciphertext.

- **The handoff is sealed on the sender's machine.** `send` encrypts it with
  AES-256-GCM under a random key made for that one handoff. The key travels in
  the link after `#` (`o.openonion.ai/h/<id>#k=…`) and in the code, which is now
  `coh4`. A browser never sends the part after `#`, so the page decrypts in the
  reader's browser and `co handoff accept` decrypts on the recipient's machine.
- **After the handshake, every message is boxed to the other agent.** The
  acceptance, questions, answers, `done` and its file, and the inbox copy of a
  later handoff are sealed with X25519 `crypto_box` from the two agents' own
  Ed25519 keys. The backend relays `[co handoff]` and a sealed blob. A box that
  does not open from the agent the backend says posted it is ignored.
- **`ask` and `done` take the link too.** A recipient whose agent accepted with
  the link can keep using it; before, `ask` with the link answered "Not a
  handoff code".
- **The recipient installs this release.** The install floor in the pasted
  prompt is 1.9.3rc5, because older co cannot read `coh4` codes or `#k=` links.

What the backend still sees: which agent dropped the handoff, the sender's
name, which coding agent the session came from, its language and size, and
when it was sent and picked up. The note to the person is ordinary mail and
carries the link; sent from your own Gmail or Outlook it does not pass through
ConnectOnion, sent from the agent mailbox it does, and the preview says so.
See [Encryption](https://github.com/openonion/connectonion/blob/v1.9.3rc5/docs/cli/handoff.md#encryption).

## Verification and limits

- New tests read what the faked backend stores and find no word of the
  handoff and no key. Two mutations (replies left unboxed, the page stored in
  the clear) turn them red.
- A real handoff between two isolated test identities on the live backend:
  send, accept by link, ask, answer, done with a patch. Every stored row was
  read back and held only ciphertext. A real `codex exec` accepted from the
  pasted line.
- The backend (oo-api v0.1.37) and the page's browser decryption
  (oo-frontend#37) were deployed first.

Known and open:

- Handoffs sent by 1.9.3rc4 or earlier (`coh3` codes) keep working and stay
  plaintext on the backend until they expire, with the messages about them.
- The first note to the person is not end to end; it is as private as the
  mailbox that sends it.
- Everything listed as open in the [1.9.3rc4 notes](1.9.3rc4.md) still applies.