A handoff record must be enough to resume cold

[schickling-assistant]

Problem

handoff is already one of the progress kinds. What a handoff must contain is unspecified, and in practice it carries an optional free-text note and nothing else — so a handoff with no content at all is a valid handoff. DQ02 is open on what a progress record is serialized as and how its identity is computed, which is a different question and leaves this one untouched.

The vision promises that "an agent or human arriving cold can read why the plan is what it is." The Rationale chain delivers that for intent. Nothing delivers it for work in flight: a Step somebody started, made partial progress on, and stopped. A successor today can observe that a start was recorded and no done was — which says the work is unfinished, and nothing whatsoever about where it got to, what was already ruled out, or what to do next. The successor's cheapest correct move is to redo it.

That is the moment the durable record is most valuable and currently emptiest, and it is not rare: it is what happens at every context boundary, every machine change, and every abandoned attempt.

Proposed content

A handoff should be refused unless it carries enough for a successor with no other context:

• what was attempted — the interpretation of the Step actually being worked, which is frequently narrower than the Step's stated work and is the thing a successor most often gets wrong;
• against which version — already required by CMP.DM-R11a, and load-bearing here, because a successor reading a handoff written against a since-superseded version needs to know that;
• what was observed — what turned out to be true, especially where it contradicts what the Step assumed. This is the field that stops the successor repeating the dead end;
• what remains — the next concrete action, not a status word. "In progress" is not a handoff;
• what evidence exists — references to whatever was already produced, so it is not produced twice.

Refusing an empty handoff is consistent with how this project already treats its other required-reason field: CMP-R03 refuses a revision without a stated reason on the grounds that "intent without it is a guess with no provenance." A handoff without content is the same guess one layer down. It is also cheap to enforce — unlike acceptance, nothing has to evaluate it; the requirement is presence, not shape.

Worth deciding: whether this constrains handoff alone or whether done deserves the same treatment. A completion that records nothing about what was actually produced has the same defect for a reader arriving later, though evidence partly covers it.

The principle underneath

Worth stating as a requirement rather than left as good practice: work state must be recoverable from the durable record alone, never from an agent's conversation history. A predecessor in-house planning design stated it as a hard boundary — recovery re-reads the durable record, and a private transcript is never consulted, because it is not replicated, not attributable, and frequently gone by the time anyone wants it.

This fits the existing contract exactly. CMP-R01 makes Compass the sole authority for accepted progress, and decision 0005 puts execution progress inside Compass specifically so it does not end up in a work-log beside the plan where every question about what happened has two possible answers. A handoff whose real content is "see the previous session" puts the authority straight back outside.

Deliberately not proposed

The same predecessor design carried session identity, orchestration state, workspace facts, and root-cause-analysis state on its progress records. Those are properties of the surrounding agent system, which this project's ontology explicitly disclaims: Compass "does not own coordination identity, messaging, presence, process supervision, or operational accounting." The list above is what remains after removing them, and it is deliberately short — every field on it answers a question the successor must otherwise answer by redoing work.