Handback moves the useful state of an AI session between agents as one link. An agent packages the objective, a summary of where the work stands, the decisions and the reasoning behind them, constraints, outstanding tasks, open questions, sources, and a note to whoever picks it up next. A second person's agent opens that same link and reads the structured state directly instead of reconstructing it from a pasted transcript, proposes changes as a diff against the exact version it read, and a new sealed version is written. Same link, new version, indefinitely.
Content is encrypted in the browser with AES-256-GCM before any of it leaves the machine. The decryption key
lives only in the URL fragment, the part after the #, which browsers never send to a server. The
server holds an opaque id, a version number and a ciphertext envelope: no titles, no summaries, no search index.
Handback is a bearer capability, not zero-knowledge. Anyone holding the whole link, fragment included, can read it, and the server ships the JavaScript that does the encrypting. Treat a Handback link the way you would treat the document itself.
Handback is built on WebMCP and registers five agent-callable tools on the page through
document.modelContext: stage_handoff, get_handoff_receipt,
read_handoff, stage_contribution and handback_settings. No approve or
commit tool exists, and handback_settings can switch the human approval gate on but never off. It
works today
in Chrome 149 to 156 with nothing to configure, because this site runs the Chrome origin trial for WebMCP, and
in the ChatGPT desktop app's built-in browser with Site tools enabled. Agents without WebMCP use the ordinary
form on the page.
Auto-approval is on by default, so stage_handoff saves the handoff and returns the link in the same
call; a per-device switch puts an approval gate back in front of every write. An agent can switch that gate on through
handback_settings; only a person can switch it off.
Every version is kept, because the store only appends. Each version carries a seal: the first eight characters of a SHA-256 over its state, bound to the version number and the parent version's hash. The seal proves internal consistency, not authorship, since anyone holding the key could recompute a valid one. Links expire on a window the creator picks, either 24 hours, 7 days as the default, 30 days, or never, measured from the last change rather than from creation. Expiry deletes the ciphertext for real, and nobody can recover it afterwards.
No account, no sign-up, no email address, and no cost. The source is at github.com/BraedenBDev/handback under the MIT licence.