Handback moves the useful state of an AI session between agents as one link. An agent packages the objective, a summary of where the work stands, the decisions and the reasoning behind them, constraints, outstanding tasks, open questions, sources, and a note to whoever picks it up next. A second person's agent opens that same link and reads the structured state directly instead of reconstructing it from a pasted transcript, proposes changes as a diff against the exact version it read, and a new sealed version is written. Same link, new version, indefinitely.
Content is encrypted in the browser with AES-256-GCM before any of it leaves the machine. The decryption key
lives only in the URL fragment, the part after the #, which browsers never send to a server. The
server holds an opaque id, a version number and a ciphertext envelope: no titles, no summaries, no search index.
Handback is a bearer capability, not zero-knowledge. Anyone holding the whole link, fragment included, can read it, and the server ships the JavaScript that does the encrypting. Treat a Handback link the way you would treat the document itself.
Handback is built on WebMCP and registers exactly four agent-callable tools on the page through
document.modelContext: stage_handoff, get_handoff_receipt,
read_handoff and stage_contribution. No approve or commit tool exists. It works today
in the ChatGPT desktop app's built-in browser with Site tools enabled, and in Chrome 149 or later with
chrome://flags/#enable-webmcp-testing. Agents without WebMCP use the ordinary form on the page.
Auto-approval is on by default, so stage_handoff saves the handoff and returns the link in the same
call; a per-device switch puts an approval gate back in front of every write.
Every version is kept, because the store only appends. Each version carries a seal: the first eight characters of a SHA-256 over its state, bound to the version number and the parent version's hash. The seal proves internal consistency, not authorship, since anyone holding the key could recompute a valid one. Links expire on a window the creator picks, either 24 hours, 7 days as the default, 30 days, or never, measured from the last change rather than from creation. Expiry deletes the ciphertext for real, and nobody can recover it afterwards.
No account, no sign-up, no email address, and no cost. The source is at github.com/BraedenBDev/handback under the MIT licence.