Private Agent Handoff

Start here

Your first local handoff

Use Python 3.11 or newer and the synthetic example supplied in the kit. Nothing is uploaded to Ontario. Dependency installation needs internet access; the demo and checks run offline afterwards.

1. Download and inspect

   Download the ZIP, extract it, then open a terminal in the extracted ontario-private-agent-handoff folder containing requirements.txt. Keep this outside a public repository.

   Download checksum · Inspect source and MIT license. The checksum checks file consistency, not an independent security audit.

2. Install in an isolated environment

   macOS / Linux

   python3 -m venv .venv
   .venv/bin/python -m pip install -r requirements.txt
   .venv/bin/python demo.py
   .venv/bin/python -m unittest -v checks

   Windows PowerShell commands

   py -3 -m venv .venv
   .\.venv\Scripts\python.exe -m pip install -r requirements.txt
   .\.venv\Scripts\python.exe demo.py
   .\.venv\Scripts\python.exe -m unittest -v checks

   Use a private Windows user directory with restrictive access controls. POSIX file modes do not configure Windows ACLs. The published release checks run on macOS; Windows is not independently validated.

3. Check the result

   {
     "status": "passed",
     "selected_fields": ["objective", "deliverable"],
     "receipt_verified": true,
     "replay_denied": true,
     "executed": false,
     "paid": false
   }

   The demo generates temporary keys in memory, signs and encrypts a synthetic brief, accepts it once, verifies the receipt and rejects a second acceptance. It prints no keys or task contents. Its temporary replay database is removed when the run ends.

   The checks must finish with OK. This is engineering verification, not proof that your production environment is secure. The demo does not run an LLM, deliver a review or spend money.

4. Connect your own reviewer

   Keep the sender's private key with the sender and the reviewer's private key with the reviewer. Pin public keys through your trusted provisioning channel. Initialize durable recipient state once, select approved fields, then deliver the envelope over your existing authenticated transport.

   Your worker calls accept() before using the brief. On any denial, stop; do not bypass policy or reset replay state. Acceptance is recorded before plaintext is returned, so this is at-most-once release, not guaranteed job completion. After a crash, a new handoff needs authorization.

   Python integration example · Step-by-step CLI and private outputs · Production checklist and limits