​

Multi-Host Mobs — Architecture & Implementation Plan (v4.1)

Implementation status: implemented. The complete phase 1-8 plus 6b implementation merged in PR #867 at fd1e275030c76af059eb7a2ab0a2f6a555617563 on 2026-07-16. Restart and rejected-run recovery follow-up #888 landed at 32510368852738e703e31b51b2a9192a96d7d205 on 2026-07-17. This file remains the historical adjudication and implementation record; current code plus the Mobs guide and Mob Architecture reference are authoritative for the shipping public surface. Post-plan amendment: PR #976 at cbaca57cc38cc71656f1163bff1e1b7492cf3373 added optional resume_from_role to private MaterializeLaunchMode::Resume. It authorizes one exact cold durable role migration, fails closed when absent or wrong, and is not a public console, agent-tool, profile, or SDK spawn field. The v4.1 text below intentionally preserves the launch contract as originally designed; this amendment is the current delta. Historical design status: adjudicated v4.1 (2026-07-07, at HEAD 0.7.22 / da467fca8; v4.1 ecosystem expansion same day). Every substrate claim was re-verified against that HEAD (file:line anchors are from it). Structure: §§1-13 are the core plan; §§14-19 are the ecosystem chapters (realms/config, resource resolution, live channels, surfaces, orchestration-adjacent systems, session lifecycle), each independently substrate-mapped and adversarially red-teamed; §20 is the threat model; §21 is operations/packaging/governance. §4.1 is the cross-chapter adjudication ledger - every conflict between chapters was decided there, and the chapter texts already reflect those decisions. Historical v4.1 statement: this document was the merged, authoritative plan. It superseded the v1 sketch (2026-06-03), the v2.1 adversarial adjudication (2026-06-15), and the pasted “RMAT-aware extension plan” draft; the v3 “leaderless peer fabric” concept remains a separate track (see Adjudication history). Companion doctrine: docs/architecture/meerkat-dogma.md. Machine registry: canonical_machine_schemas() in meerkat-machine-schema/src/catalog/mod.rs.

​

1. Goal

• Agents communicate by identity (AgentIdentity), never knowing whether a peer is local or remote.
• Users observe and control every member — including remote and remotely-spawned members — through the same console/API surfaces: list, status, history, live events, send, cancel, retire, wire.
• Mob membership/topology stays MobMachine authority. Comms delivery stays meerkat-comms authority. Session execution/history stays runtime/session authority. MobKit stays a projection layer.

Host A: A            (controlling host: runs the MobActor / MobMachine)
Host B: B1, B2, later B21, B22   (B2 spawns B21/B22 onto Host B)
Host C: C1, C2, C3

Edges:  A<->B1  A<->C1  A<->C2  B1<->B2  C1<->C2  C2<->C3

​

2. Adjudication history (do not re-litigate silently)

​

3. Constraints (v1, corrected wording)

• Realms are not distributed. A member’s sessions/events/credentials persist in the member host’s local realm. Cross-host reads are bridge-served projections, never remote store handles.
• One process hosts many members; one TCP ingress port per host process (not per agent, not per member).
• No new authority owners. No parallel roster, no second topology counter, no host-local fence rotation, no comms-owned route authority. Every new semantic fact folds into an existing machine or a catalog-generated scoped authority.
• Protocols are separated; transport is shared. Peer data (MessageKind) and supervisor control (BridgeCommand over the supervisor.bridge intent) already share the comms envelope, listener, and inbox — that stays. Separation is at the protocol/authority level: typed payloads, distinct admission authorities, one ingress. (The draft’s “do not merge the planes” wording is retired; read literally it contradicts shipped reality — meerkat-runtime/src/comms_drain.rs:1687 dispatches bridge commands out of the ordinary drain.)
• The peer envelope does not change in v1 (see D5-adjacent rationale in §7.1).
• MobKit consumes Meerkat surfaces; it grows no roster, directory, or authority.

​

4. Decisions

• Plane (a), host↔mob: a host bind ceremony: an out-of-band one-time bootstrap token derives a domain-separated BridgeHostBootstrapProof bound to the exact supervisor/host/mob/epoch/generation tuple → durable host authority record fenced by the supervisor authority epoch. The raw bearer never crosses the signed-but-unencrypted bridge. Possession-proof + Ed25519 identity; all-or-nothing per host. Comms bootstrap tokens are never principal auth.
• Plane (b), principal→mob: typed ControlScope grants owned by MobMachine (grant lifecycle = machine facts) and enforced through a sealed resolved policy at the controlling host’s command dispatch — the ToolExecutionPolicy/ExecutionPolicyGatedDispatcher pattern (meerkat-core/src/tool_execution_policy.rs), including its fail-closed UnresolvedInherit discipline. Bridge commands are only ever sent by the already-authorized supervisor, so plane (b) enforcement lives entirely on the controlling host (MobCommand admission + operator surfaces), not on member hosts.

​

4.1 Cross-chapter adjudication ledger (v4.1)

• A1 — Spec compile locus: the materialize spec ships STRUCTURED RESOLVED INPUTS (resolved profile + definition extract + overlay) and the member host re-runs the ONE build_agent_config compiler — a member-side “realizer” would be a second parallel build path. All divergence-prone inputs are pre-resolved controlling-side: Path skills → Inline, prompt tri-state never Inherit, model AND provider pinned typed, tool policy never Inherit; the member-host factory appends NO host-config-derived prompt sections for materialized members. §14.2/§15.3.
• A2 — shell_env never travels: typed SecretBearingField admission reject; host env is declared by NAME (required_env_keys) and verified at preflight. The payload’s non-confidentiality posture depends on this.
• A3-final — tools.schedule IS permitted on remote members (reverses the draft reject): session-target schedules are realm-local and fire correctly on the owning host; member-side mob-target schedules fail TYPED at fire. Only workgraph stays admission-denied (its failure shape is silent split-brain with no typed backstop). §18.5.
• A4 — One non-portability vocabulary, one enforcement point: NonPortableResource { kind } minted on the machine spawn-exec ladder at the BeginSpawnExec choke-point (the tool-seam-only admission is bypassed by RPC/embedder paths today). Inherited-OPEN workgraph resolves to disabled-with-typed-record; EXPLICIT assertion rejects.
• A5 — Secrets-on-bridge invariant, refined: durable credentials/leases/provider secrets NEVER appear on new multi-host bridge payloads (type-level). BindHost carries a tuple-bound HMAC, never its descriptor bearer. The sanctioned multi-host exception is single-use, 60s-TTL, channel-pinned live WS tokens (§16), acknowledged as plaintext-exposed in §20. The older BindMember.bootstrap_token protocol still sends its bearer directly and is an explicit pre-existing residual, not precedent for new commands; v2 seed = encrypted comms transport (or a separately versioned member-bind proof).
• A6 — Launch mode has one wire owner: MaterializeMember.launch: {Fresh | Resume{session_id}}; PortableMemberSpec structurally excludes the domain launch_mode; Fork never crosses as a mode (it collapses to rendered text controlling-side, §19.L2).
• A7 — One durability flag: HostCapabilityFlags.durable_sessions (the host’s realm backend is persistent/event-store-backed). Event replay, archive capability, and console lifecycle flags all derive from it.
• A8 — One member-originated command family: MemberOperatorRequest (member host → controlling host over supervisor.bridge, request-id idempotent under the signed requester generation+fence tuple), machine-admitted via ResolveMemberOperatorAdmission. It carries member-side operator tool calls AND member-originated spawn requests (§15 R6, §18 O3) — no second upcall channel exists. The controlling host durably records Pending before execution and an immutable terminal reply afterward (§15.5).
• A9 — ControlScope v1 = ten variants: List, ReadHistory, SubscribeEvents, SendCommand, Cancel, Retire, WireTopology, Live, AdminHost, AdminGrants. AdminHost stays exactly bind/revoke hosts; grant administration is AdminGrants. RewriteTranscript/Approve arrive with their features (both v2).
• A10 — Portable MCP declarations: secret-bearing values (stdio env, http headers) are structurally absent from the wire type — required env-key/header NAMES only, satisfied host-locally; inexpressible profile MCP config is a typed SecretBearingField reject.
• A11 — Preflight adjudicator: shell observes, MobHostBindingAuthority adjudicates (ResolveMaterializePreflight from typed observations). One check inventory: model+provider pin, binding resolvable, required env keys present, stdio commands discoverable, memory backend, durable_sessions when required, engine/protocol range. No PreflightMember verb — materialize-integral.
• A12 — Digest: SHA-256 over RFC 8949 canonical CBOR of PortableMemberSpec (the envelope-signature canonicalization mechanics — stable across struct evolution; serde_json is not canonical and is not used). Machine-authorized at AuthorizeSpawnProfile; a SIBLING of the spec on the commands (never a field of the bytes it digests); host recomputes (SpecDigestMismatch), ack echoes, CommitSpawnMembership guards echo == authorized.
• A13 — Naming: the console projection family is mob/hosts; the bridge verb stays HostStatus.
• A14 — Multi-tenancy: MobHostBindingAuthority is MOB-KEYED (Map<MobId, SupervisorBinding>, Map<(MobId, AgentIdentity), …>); one daemon serves many mobs/controlling hosts; same-mob second supervisor = typed AlreadyBound until RevokeHost.
• A15 — ErrorCode registry: exactly four new ErrorCode variants — ScopeDenied, HostUnavailable, StaleCursor, StaleFence (allocations §17.4) — with all four projections + roundtrip tests + schema/SDK regen in phase 1. Every other new cause stays bridge/domain-level and maps onto existing codes — including NonPortableResource, which is spawn-admission machine vocabulary (MobSpawnMemberAdmissionKind) surfacing through an existing validation code, while StaleFence is a live bridge cause (materialize/release/command paths) that needs a stable console rendering. (v4.1.1 errata: this line originally read NonPortableResource in place of StaleFence, contradicting §17.4’s worked allocation table; the table was implemented and this line corrected to match — phase-1 implementation review.) CLI mob-verb typed-exit path and MCP McpToolError typed mapping are NEW seams (phase 7), not existing ones.
• A16 — Principal identity (plane b): v1 local RPC/REST/stdio surfaces authenticate as the owner (implicit full scope, unchanged — MobKit keeps working); the second-principal class in v1 is remote comms peers. A member upcall is signed by its member peer key for transport admission, but executes in the separate generated agent-authority lane and never acquires principal grants (§15.2). Bearer-token → PrincipalId auth for rkat-rpc --tcp is the named v2 seed (§21.7).
• A17 — Flow outcomes decoupled from observation: dispatching a tracked remote turn records a MobMachine obligation (pending_remote_turn_outcomes); the poll pump runs while subscriptions OR obligations exist. terminal_seq is pinned to the durable StoredEvent.seq domain; durable_sessions=false hosts are RejectedHostIncapable at dispatch classification.
• A18 — No shadow inputs to machine classification: ClassifyFlowStepDispatch reads self.member_runtime_modes (machine state), never a shell-supplied mode.
• A19 — Disposal order: ReleaseMember = outer quiesce (cancel → runtime retire → drain) THEN the commit-first archive protocol; the retire AND destroy Observe*RetirementArchived signals both gain the typed disposal field in one change-set. §19.L3/L4.
• A20 — Revival source: host-autonomous from the durable spec row at the STORED (generation, fence) (partition-resilient); HostRebound reconciles stale fences via ReleaseMember; new specs only ever arrive machine-issued at a higher fence. §14.6/§15.7.
• A21 — Live ordering + scope carve-out: phase 6b lands AFTER phase 6 (pump + single-flight relaxation are prerequisites); §12’s direct-observer non-goal explicitly carves out the live MEDIA plane as the one declared D2 exception (§16 DL1).
• A22 — Fence containment honesty: nothing validates fence/epoch member-side on delivery in v1, and host-local realm writes sit outside the fence path entirely — stated plainly here and in §20, never laundered.

​

5. Authority model

​

6. Machine deltas (catalog first — Rule: no production-only semantics)

​

6.1 MobMachine — hosts and placement

mob_hosts:                 Set<HostId>
host_public_keys:          Map<HostId, PeerSigningKey>
host_endpoints:            Map<HostId, PeerAddress>
host_authority_epochs:     Map<HostId, u64>
host_bind_phase:           Map<HostId, HostBindPhase>       // Requested | Bound; absence = unbound
host_capabilities:         Map<HostId, HostCapabilityFlags> // SINGLE enumeration (all chapters extend THIS line, nowhere else): protocol range, engine_version, durable_sessions, autonomous_members, hard_cancel_member, tracked_input_cancel, memory_store, mcp, resolvable_providers, approval_forwarding. Admission-gating: protocol range, durable_sessions-when-required, autonomous_members-when-required, tracked_input_cancel for durable tracked turns, memory_store/mcp-when-profiled; advisory: resolvable_providers, engine_version. Live capability is NOT a flag: presence in host_live_endpoints IS the capability (§16 DL5)
member_placement:          Map<AgentIdentity, HostId>       // ABSENT = controlling host (local). Present = remote.
member_materialization_failures: Map<AgentIdentity, String> // mirrors member_restore_failures
host_live_endpoints:       Map<HostId, LiveWsEndpointUrl>   // §16 DL5; absence = live-incapable
pending_remote_turn_outcomes: Set<(AgentIdentity, InputId)> // §18 O2/A17: keeps the pump obligated

​

6.2 MobMachine — wiring install obligations (D4)

pending_route_installs: Set<RouteInstallObligation>   // Install only: { edge: WiringEdge, host: HostId }

​

6.3 MobHostBindingAuthority — new catalog-generated scoped authority (host side)

supervisor bindings:    Map<MobId, { peer_id, epoch, bind_phase }>       (MOB-KEYED, A14 — one daemon, many mobs)
materialized members:   Map<(MobId, AgentIdentity), { generation, fence_token, session_id, spec_digest, spec_bytes }>
dedup memory:           per (mob, identity): materialize AND release outcomes (replay returns the recorded result; stale tuple → StaleFence; same tuple + different digest → SpecDigestMismatch)
turn-outcome journal:   Map<(AgentIdentity, Generation, InputId), RecordedTurnOutcome>   (§18 O2)
preflight adjudication: ResolveMaterializePreflight over shell-supplied typed observations (A11)

​

6.4 MeerkatMachine — member-side admission extension

​

6.5 MobMachine — subscriptions and grants

• Event subscription: the adjudication seam exists with two outcomes — AuthorizeAgentEventSubscription { agent_identity, session_id } / RejectAgentEventSubscription { reason: MemberNotFound | NoSessionBinding } (mob_machine.rs:1323-1324). Add the third outcome AuthorizeExternalAgentEventSubscription { agent_identity, host } guarded on member_placement/external_peer_edges. Extend AuthorizeAllAgentEventSubscription to carry the external member set next to session_bound_runtimes — today the mob-wide stream silently omits external members (AuthorizedMobEventRouter filters to session-bound, meerkat-mob/src/runtime/event_router.rs:48, handle.rs:2582-2653); this plan kills that silent cap.
• Grants: operator_grants: Map<PrincipalId, GrantRecord { scopes, expires_at_ms }> with GrantOperatorScopes / RevokeOperatorScopes inputs. Expiry is data checked at the enforcement seam (shell reads the clock; the sealed policy compares — mirrors how ToolExecutionPolicy keeps policy resolution out of the machine while lifecycle stays machine-owned).

​

7. Wire & protocol deltas (meerkat-contracts; one versioned protocol)

• Placed plain DeliverMemberInput separates its canonical non-nil transport/idempotency input_id from optional transcript_interaction_id. IngressAccepted always mints a fresh retry-stable transport key and carries only a caller-supplied transcript id (None remains absent for ordinary runtime minting); it requests no terminal custody. TurnCompleted records controller custody before SubmitWork and uses the same canonical UUID for transport, transcript, waiter, and retained host sidecar, with explicit outcome_tracking: Interaction. The receiver rejects non-canonical/nil ids, under-V4 use, a transcript carrier without exact placed residency, and any tracked split between the two ids.
• ReadMemberHistory { supervisor, epoch, protocol_version, from_index, limit } → BridgeReply::MemberHistoryPage (mirrors SessionHistoryPage; transcript snapshot pages). The encoded reply is byte-bounded below the transport ceiling: a multi-row page returns the maximal fitting prefix with exact next_index, while one untransportable row rejects as typed HistoryRowTooLarge { index, encoded_bytes, max_bytes } rather than returning an empty loop or silently corrupting fork context.
• PollMemberEvents { supervisor, epoch, protocol_version, cursor: MemberEventCursor | Tail, max, outcome_acks: Vec<(generation, input_id)>, max_outcomes, wait_ms } → BridgeReply::MemberEventsPage { generation, events: Vec<EventEnvelope>, next_seq, watermark, turn_outcomes, outcomes_complete }. Event and outcome windows are independently count-bounded and the encoded reply is byte-bounded below the transport ceiling. outcome_acks names only rows consumed from the prior page; the member host prunes those exact durable rows. An absent ack is a no-op with no tombstone, so a journal commit delayed behind the terminal event cannot be lost. Long-poll: wait_ms bounded well under the bridge transport budget. Events are served from EventStore.read_from when durable_sessions, else from a bounded live buffer with typed StaleCursor on overrun.
• HardCancelMember { supervisor, epoch, protocol_version, operation_id, expected_run_id, reason } — variant exists on the wire today but every receiver rejects it and nothing sends it (provisioner.rs:3297-3312; comms_drain catch-all). v1 implements the receiver arm through the machine-admitted hard-cancel path and a production sender, gated by the Cancel scope. Both identity fields are REQUIRED: the sender observes and pins the current runtime RunId, mints one OperationId, and every transient transport retry reuses the byte-identical tuple. Receiver semantics are level-triggered and exact-run-scoped: compare expected_run_id with the machine-owned current run under the same per-session mutation gate as InterruptCurrentRun; while it still matches, reassert the hard cancel; once it is unbound or lifecycle-terminal, ACK. A newer current run therefore proves only that the expected run is terminal and is never interrupted by a stale retry. ACK means exact-run terminal truth, not merely that one interrupt signal was delivered.

• BindHost { supervisor, epoch, protocol_version, expected_host_peer_id, expected_address, bootstrap_proof } → capabilities reply. bootstrap_proof is a dedicated HMAC newtype; the descriptor’s raw bootstrap_token is not valid wire vocabulary here.
• MaterializeMember { spec: PortableMemberSpec (§15.3), spec_digest, generation, fence_token, launch: MaterializeLaunchMode { Fresh | Resume { session_id } } } → MemberMaterialized { member_pubkey, member_peer_id, advertised_address, session_id, spec_digest (echo), engine_version, launch_outcome, resolved_auth_binding }. Idempotent on (spec.agent_identity, generation, fence_token): replay returns the recorded result; a lower tuple is a typed StaleFence reject; same tuple + different digest is SpecDigestMismatch (A12). Member identity has exactly one carrier (spec.agent_identity), launch mode has exactly one carrier (A6), and budget has exactly one digest-covered carrier (spec.overlay.budget_limits, §18 O4).
• ReleaseMember { agent_identity, generation, fence_token } — FULL durable disposal on the owning host (outer quiesce, then commit-first archive; typed MemberReleased { disposal } reply — §19.L3); also the reconciliation verb for orphans.
• InstallPeerTrust { agent_identity, peer: TrustedPeerDescriptor } / RemovePeerTrust { ... } — realize RouteInstallRequested on the owning host through the member’s machine-gated apply_trust_mutation seam (never direct TrustStore writes).
• HostStatus {} → materialized-member inventory + health + refreshed BridgeCapabilities (including its single engine_version carrier); feeds reconciliation, reachability projection, and the periodic poll that doubles as orphan-reconciliation driver (§21.2).

​

7.1 Why the envelope stays untouched (recorded so it is not re-proposed)

​

7.2 Host bind ceremony (plane a)

1. Operator starts rkat mob host on Host B. The host loads/mints its host keypair (Keypair::load_or_generate in the host identity dir), binds the acceptor, and writes a host binding descriptor (the --comms-binding-out shape, host flavor: {kind: "host", address, ed25519 public_key, bootstrap_token}).
2. Operator (or automation) hands the descriptor to the controlling mob: BeginHostBind → routed RequestHostBind → derive the exact request-bound HMAC from the descriptor token → bridge BindHost with the proof, expected identity, and expected address. The raw token remains out-of-band.
3. Host validates via MobHostBindingAuthority (token, sender, address — the validate_bind_request shape, comms_drain.rs:879-965), records the supervisor binding at the offered epoch, replies capabilities.
4. CommitHostBind records {HostId, pubkey, endpoint, capabilities, epoch} in MobMachine. Supervisor rotation fan-out (already fail-closed with pending-rotation memory) extends its recipient set to bound hosts.

​

7.3 Placement and materialization

​

7.4 Events, history, completion, cancel — closing the observation gap

• History: console mob/member_history (new RPC/REST/MCP surface, by AgentIdentity) → controlling host: local member ⇒ existing session read; remote ⇒ ReadMemberHistory proxy. Same page shape either way.
• Events: the controlling host runs a poll pump per remote member (schedule-driver-style loop) driving PollMemberEvents from the last cursor, wrapping results as AttributedEvent { source, source_fence_token, role, envelope } (the existing merge item, meerkat-mob/src/event.rs:509-518) and feeding AuthorizedMobEventRouter next to the local SelectAll. Dual cursor: the source (generation, seq) is preserved on each item; the merged stream’s ingest order is the router’s own. A ring overrun or immutable event row larger than the bridge reply budget is projected to subscribers first as AgentEvent::StreamTruncated with a typed RemoteCursorOverrun / OversizedRemoteEvent reason, then the durable cursor advances; loss is never log-only. Console UX is unchanged (mob/stream_event push from the controlling host). Pump lifecycle follows the third subscription outcome (§6.5) OR outstanding pending_remote_turn_outcomes obligations (A17) — flow completion never depends on a console watching.
• Completion: falls out of events — terminal AgentEvents arrive through the pump; wait_one/wait_all/flow-step completion for remote members consume the merged stream (the spawn_turn_completed_reply degradation path is upgraded to it). DeliverMemberInput keeps replying at admission (unchanged; the reply deliberately carries no turn payload).
• Hard cancel: receiver arm lands (machine-admitted), capability flips, Cancel scope gates it at the controlling host. The controlling sender first observes the exact current run, then sends required { operation_id, expected_run_id } identity. The receiver repeatedly applies the immediate interrupt authority only while that exact run remains current and withholds ACK until it is unbound/terminal. This is bounded convergence over an edge-triggered executor signal, not an edge-ack API. Timeout while the expected run remains bound is typed Unavailable; a transient resend is byte-identical, and if its prior ACK was lost after run A ended, replay ACKs A’s terminal truth without touching a newer run B.

​

7.5 Reachability (projection)

​

8. Scoped control (plane b)

enum ControlScope { List, ReadHistory, SubscribeEvents, SendCommand, Cancel, Retire, WireTopology, Live, AdminHost, AdminGrants }   // A9: AdminHost = bind/revoke hosts ONLY; grant admin = AdminGrants; Live gates the §16 family

• Grants are MobMachine facts (§6.5), keyed by PrincipalId (comms-principal = PeerId; local operator contexts injected — Gotcha #19: operator authority is injected, not ambient; MobToolAuthorityContext + seal at meerkat-core/src/service/mod.rs:491,511 is the vocabulary to extend).
• Enforcement: a sealed ResolvedControlPolicy checked at the controlling host’s two chokepoints — MobCommand admission and the operator surfaces (RPC/REST/MCP mob handlers + agent-facing mob tools). Deny = typed ScopeDenied { required, presented }. Fail-closed: an unresolvable principal has no scopes.
• Defaults: the owning session (owner_bridge_session_id) holds implicit full scope — single-user CLI behavior is unchanged. Every other principal is default-deny until granted. Scope semantics honored end-to-end: SendCommand without ReadHistory can drive but not read; SubscribeEvents without Cancel can watch but not stop; WireTopology is distinct from SendCommand; AdminHost (bind/revoke hosts) is distinct from everything.
• Principal identity (A16): v1 local RPC/REST/stdio connections authenticate as the OWNER (implicit full scope — today’s behavior, so MobKit and single-user CLI are unaffected by default-deny). Remote comms peers are the second principal class. MemberOperatorRequest uses the member PeerId only as a signed transport/admission fact; its operator capabilities come exclusively from the controlling-host-minted generated agent authority, never a principal grant. Bearer-token → PrincipalId authentication for rkat-rpc --tcp is the named v2 seed (§21.7).
• Grant durability: operator_grants persist through the mob store like every MobMachine fact; supervisor rotation does NOT clear grants (principal→mob facts, not epoch-scoped); expiry is data compared at the enforcement seam (a restored mob’s expired grants stay expired).
• Ordering rule: no remote read/mutation surface ships before this lands (phase 5 precedes phase 6; phase 6b after 6).

​

9. Failure semantics (typed, enumerated)

​

10. Phases (exit gates, no calendar)

1. Adjudication + catalog deltas. This document is the phase-1 artifact. Land §6 in one catalog change-set (fields, inputs, effects+dispositions, invariants, MobHostBindingAuthority DSL, MeerkatMachine admission coverage) + §7 contracts (V4 commands, replies, causes, cursor, projections). TLC bounds: 2 hosts × 3 members.
2. Host bind + acceptor + host role. D1 demux in meerkat-comms (registry install/remove from machine effects only; mandatory peer auth; acks signed per-member; pairing branch host-scoped); §7.2 ceremony end-to-end; rkat mob host daemon (D6); host binding descriptor.
3. Placement + materialization. §7.3 end-to-end including B2→B21/B22 on Host B; HostMaterialized binding variant; ExternalBackend stub deleted; idempotent retry; orphan reconciliation; revival integration.
4. Cross-host wiring install. §6.2 obligations; placement-aware transport selection; wire_members_batch local-only rejection removed; unwire symmetry; fail-closed partial install with durable retry.
5. Control scopes. §8 grants + sealed policy at both chokepoints; ScopeDenied; owner-implicit-full default. Must land before phase 6 ships any remote read.
6. Events / history / completion / cancel. §7.4: DSL third outcome + all-subscription external fan-out; ReadMemberHistory + PollMemberEvents + pumps + router merge with dual cursors; completion consumption (incl. the §18 O2 turn-outcome sidecar + A17 obligations); run-scoped level-triggered HardCancelMember receiver + sender with required operation/run identity and ACK-after-terminal semantics; bridge single-flight relaxed; remote-source fork context (§19.L2); BRIDGE_CLASSIFIER_FILES extended. 6b. Remote live channels (§16; ordered AFTER phase 6 — the pump and the single-flight relaxation are prerequisites; the LiveOrchestrator + projection-sink four-role extraction may run in parallel as pre-work).
7. Surfaces. RPC/REST/MCP/SDKs: by-identity member_history, member event streams for remote members (existing mob/stream_event now covers them), host register/status, route-install status, grant management (rkat mob grant/revoke, host verbs). RPC stays the console↔controlling-host transport; rkat-rpc --tcp is never a host↔host control path (one control plane: the bridge).
8. MobKit projection. Remote/local members project into the existing console identity records; remote history/events consumed via the new Meerkat surfaces; console contracts stable; no MobKit-owned roster/directory (verified by review, not assumed). (v4.1.2 errata, phase-8 consequence pass, verified against meerkat-mobkit HEAD pinning =0.7.25: (1) all three negatives HOLD — member listing always projects per-call from MobHandle::{list_members_*, roster()} with no MobKit-owned copy; zero host-directory concepts (contact_directory.rs is an unrelated cross-mob gateway federation map, mob_id→transport); live channels delegate to the handle with no MobKit-side registry. (2) Console contracts are stable by construction: IdentityRuntime/ConsoleFrame records key on AgentIdentity, not session id, so remote members project without shape change. (3) Meerkat is NOT missing a projection surface — the phase-7 library API carries everything MobKit needs (MobHandle::{member_history, hosts, route_installs, bind_host, revoke_host, hard_cancel_member, member_live_*, grant_scopes/grants}, MobMemberStatusResult.placement, WireMobErrorDetail). (4) Recorded DOWNSTREAM asks (MobKit-repo work, out of this plan’s scope): bump the meerkat pin past 0.7.25; read remote transcripts via by-identity member_history instead of realm-local session-id reads (the console backfill via resolve_bridge_session_id_observation, the memory-hygienist SessionServiceRevisionSeam::read_messages, and the IdentityRuntime session-continuity layer are all in this class); route remote member events/live deltas through the pump-backed surfaces instead of per-member local subscribe_agent_events; use hard_cancel_member for remote force-cancel (both the RPC path and the HTTP-console mobkit/force_cancel_member); surface placement; adopt the typed mob-family codes (WireMobErrorDetail, -32025..-32028) on the mob verbs instead of -32000 + format! laundering — the separate session-lifecycle string-sniff (is_stopped_session_archive_retire_rejection) is a pre-existing meerkat-session workaround NOT covered by those codes and needs its own typed seam.)

​

11. Test matrix (lane-mapped; deterministic lanes are the CI ratchet)

• mixed A/B/C topology: identity-routed send local↔remote both directions; B1↔B2 same-host inproc selection
• many identities, one acceptor: demux by to, per-member ack signing, misaddressed reject, unregistered-identity reject
• mandatory peer auth on acceptor cannot be disabled; envelope byte-compat pin (no signed-region drift)
• host bind ceremony: token single-use, sender mismatch, address mismatch, capability capture, epoch record
• remote spawn ladder: B2→B21 full walkthrough; materialize retry deduplicates; stale-fence materialize rejected; orphan reconciliation releases at stale fence; revival classification on materialize failure; Broken refuses retry
• wiring: partial install leaves obligation + unusable edge fails closed; retry drains; unwire removes trust and subsequent delivery is rejected; batch wiring with mixed placements
• events: durable cursor resume across pump restart AND member respawn (fresh sessions reset; same-session Resume fences visibility at persisted generation_start_seq); mob-wide stream includes remote members; completion for remote members via merged stream; long-poll does not block lifecycle commands; StaleCursor on ephemeral overrun
• history: remote page read == local page shape; scope matrix — each ControlScope grants exactly its verbs, ScopeDenied carries required/presented; work-only cannot read history; read-only cannot cancel
• hard cancel: wire decode requires operation_id + expected_run_id; an edge signal missed before the executor arms is reasserted until the exact run unbinds; ACK is observed only after unbind/terminal; replay the same operation for run A while run B is current and prove B receives no interrupt; transient sender resend preserves both ids byte-for-byte
• rotation: bound hosts in fan-out; pending-rotation retry with a host that rebound to current authority
• TLC (make machine-verify) at 2×3 bounds green for all new state

​

12. Non-goals (v1) and v2 seeds

​

13. Implementer gotchas (verified traps)

1. BRIDGE_CLASSIFIER_FILES is a hardcoded allowlist — extend it for every new bridge-reply consumer (§7.4).
2. RuntimeHostInfo must stay anti-authority (pinning test at wire/host.rs:181-210) — do not enrich it with host/placement authority facts.
3. DSL wiring inputs are plural; the singular names are bridge commands. Do not invent WireMember DSL inputs.
4. No member-side fence/epoch validation exists on delivery today — the host-side StaleFence checks in §6.3 are new work.
5. ExternalBackend (provisioner.rs:2580) is an empty stub — delete, don’t extend.
6. MobSupervisorBridge single-flight request_lock will serialize long-polls against lifecycle commands unless relaxed (§7.4).
7. Trust rows are never seeded from config and persisted seeds are rejected at startup (comms_runtime.rs:1620-1632) — all trust flows through apply_trust_mutation under machine authority; the acceptor registry follows the same rule.
8. Three sequence domains exist (session-task seq, per-RPC-stream seq, durable store seq) — only the durable store seq is a cursor; never leak the others into the wire cursor.
9. Re-fencing on re-acquire is intentional (fencing mechanism, not churn) — do not “fix” monotonic fence bumps on host rebind.
10. Effects need typed dispositions (seam-inventory) and commands need typed classification (runtime_alphabet_parity) — budget for these in every machine delta, they are CI failures, not review notes.

​

14. Realms, config, state locality, credentials (host-realm doctrine)

This section is the authoritative answer to “where does a remote member’s state live, which config governs its build, and how do its credentials resolve.” It builds on D1–D6 and changes none of them.

​

14.0 Decisions

• Omitted spec.auth_binding (the default; SpawnMemberSpec.auth_binding: Option<AuthBindingRef> is explicit-only, no ambient promotion — meerkat-mob/src/runtime/handle.rs:1895-1900): candidate walk with preferred_realm = mob.{mob_id} (factory.rs:3983-3988 → resolve_auth_binding_candidates_for_provider, connection.rs:1139-1176). Since mob.{mob_id} is virtually never a configured [realm.*] section (zero producers at HEAD; consumers only meerkat-core/src/lib.rs, connection.rs, meerkat-mob/src/build.rs), the absent head contributes nothing (connection.rs:736-742), the implicit global tail applies (connection.rs:772-778), and resolution lands on Host B’s ~/.rkat global-doc bindings or the synthetic env_default (allow_env_default = true at both factory call sites, factory.rs:1744,1765; synthesis connection.rs:1168-1170). Deliberate affordance, zero new machinery: an operator MAY define [realm."mob.<id>"] in a member host’s config to scope that host’s credentials per mob — the chain walk already honors it.
• Explicit spec.auth_binding: travels as the structural AuthBindingRef { realm, binding, profile, origin } (no string form, connection.rs:216-235); an env_default-origin ref is rejected before any chain walk (connection.rs:1030-1034); resolution is the strict owner-stamped walk of the named realm’s chain with head_required = true (connection.rs:1037-1044) on Host B’s config, then ProviderRuntimeRegistry.resolve enforces owning-realm equality (meerkat-llm-core/src/provider_runtime/registry.rs:208-213). The name travels; the material cannot: the token store is machine-local (dirs::config_dir()/meerkat/credentials, meerkat-auth-core/src/auth_store/mod.rs:83-89, keyed by TokenKey{realm,binding,profile}, meerkat-core/src/auth/token_store.rs:24-29), env is Host B’s process env (ResolverEnvironment::with_process_env, factory.rs:3961), and the AuthMachine lease is minted on Host B’s per-process handle (factory.rs:4065-4078). Credential writes stay strict-owner and host-local (resolve_write_owner, connection.rs:1213-1240); there is no remote auth login.
• env_default provenance is allowed on member hosts (same posture as any rkat process) and recorded: the MemberMaterialized ack gains resolved_auth_binding: Option<AuthBindingRef> where None ⇔ synthetic env_default — exactly the discipline the factory already applies to the durable metadata stamp (build_config.auth_binding = Some(resolved) iff a lease-bearing configured binding, else None; factory.rs:4089-4093, stamped at :5474/:5511). Projection-only (feeds mob/member_status); never consumed for a later build.
• shell_env never crosses hosts (A2): a remote spec carrying inline shell env is a typed SecretBearingField admission reject — the payload’s non-confidentiality posture (threat model, §20) rests on the type-level absence of secret-bearing fields. Remote members’ shell subprocess environment comes from Host B (process env / host config), with required keys DECLARED by name in the spec (required_env_keys) and verified at the Tier-2 preflight. Local (controlling-host) members keep today’s shell_env semantics unchanged (handle.rs:1881-1882).

• Tier 1 (advisory, bind-time): HostCapabilityFlags gains resolvable_providers: Set<Provider> — computed by a presence-level probe on the member host (per provider: default-chain candidate resolution over Host B’s effective config + credential-material presence read from env/token store; no network, no OAuth refresh). Captured at CommitHostBind, refreshed on HostRebound and on every HostStatus reply via a new RefreshHostCapabilities input. ResolveSpawnMemberAdmission consults it ONLY for specs that resolve credentials via the default chain (auth_binding = None) — the advertised set describes default-chain resolvability and says nothing about explicit bindings, which may resolve from realms the probe never walks. Miss ⇒ typed reject ProviderUnavailableOnHost { host, provider }; remedy is provisioning the host and re-probing (bind/status refresh). Staleness is declared: the flags are an admission hint, never the gate.
• Tier 2 (authoritative, materialize-time): on Host B, after MobHostBindingAuthority admission (fence + dedup) and BEFORE any session/state side effect, the host runs a typed build-preflight: model/provider identity against Host B’s registry (resolve_provider_from_registry incl. traveling custom_models, factory.rs:3055-3128,3870-3879; self-hosted binding presence :3068-3093), connection-target resolution (explicit or candidates), and provider credential resolve. Any failure is a typed MaterializeBuildRejected — nothing half-builds: no create_session, no acceptor registration, no materialized-member record; dedup memory records only successes, so retry re-runs preflight. The preflight is shell-executed effect work whose typed outcome feeds the controlling machine (ResolveMemberMaterialization), so no host-side semantic state depends on it — authority discipline preserved.

​

14.1 State locality map (one row per fact; all Host B paths under the daemon realm)

​

14.2 The portable spec — what travels, what cannot

​

14.3 Config fact table — pinned vs declared-host-local

​

14.4 Typed failure taxonomy — “Host B cannot build the member”

​

14.5 Bind ceremony additions (folds into §7.2)

​

14.6 Member-host restart / resume (completes §10 row)

​

14.7 Non-goals (v1) — each with typed degradation, never silent

• No distributed realms / no store replication: cross-host reads are bridge projections only; a remote store handle is unrepresentable (no wire verb exists).
• No credential distribution: no key, token, lease, or secret in any bridge payload (type-level: PortableMemberSpec has no credential-material field); an unprovisioned host fails typed MemberBuildRejection::ProviderAuth { missing_secret } at materialize preflight.
• No per-host binding alias map (mapper F3-C): one binding vocabulary; a name that doesn’t resolve on the placed host is BindingUnresolvable, and the remedy is out-of-band provisioning of Host B’s config + token store.
• No cross-host inherited tool-visibility handoff: SpecNotPortable { inherited_tool_filter } typed admission reject; tool_access_policy travels.
• No per-spawn in-process tool overlays for remote members: SpecNotPortable { external_tools } typed admission reject.
• No config snapshot shipping (mapper F1-B): host-local facts diverge by declaration (§14.3 table), pinned facts cannot diverge.
• No per-mob realm directories on member hosts (mapper F6-B): release = archive semantics in the daemon realm.
• No remote auth login / credential writes over the bridge: strict-owner writes stay host-local (connection.rs:1213-1240).
• No byte-identical builtin skills across binary versions: skew bounded by V4-at-bind; host binary version observable in HostStatus.

​

14.8 Implementer gotchas (verified, additive to §13)

11. resume_override_mask.model is resume semantics — do NOT reuse it to pin the mob model; that’s what ModelSelection is for (R4; factory.rs:4024-4033 gains the second consult, nothing else changes there).
12. The materialize ack’s resolved_auth_binding: None ⇔ env_default mirrors the metadata stamp discipline at factory.rs:4089-4093 — do not invent a separate provenance enum.
13. The Tier-1 probe must never trigger OAuth refresh or provider network I/O — presence-level reads only, or bind latency and token churn become host-bind side effects.
14. sanitize_realm_id mangles dots (realm.rs:267-278) — never derive a path from mob.{mob_id}; it is not a location.
15. Dedup memory keys on (identity, generation, fence, spec_digest) — omitting the digest silently replays a stale spec as “already materialized”.

​

15. Resource resolution: profile material, skills, MCP, hooks, memory, models

​

15.1 Verified substrate (what a member build consumes today)

• The controlling host builds every member in-process: MobActor → build_agent_config(BuildAgentConfigParams) → to_create_session_request → local SessionService (meerkat-mob/src/runtime/actor.rs:9204-9250; meerkat-mob/src/build.rs:143-344, 487-511). Two in-process overrides apply after compilation: default_llm_client (actor.rs:9229-9231) and per-member auth_binding (actor.rs:9232-9235).
• Everything the compiler reads is serializable except five in-process handle families: profile.tools.rust_bundles (names of Arc<dyn AgentToolDispatcher> registrations — meerkat-mob/src/profile.rs:54-60, resolved at meerkat-mob/src/runtime/tools.rs:252-259), SpawnMemberSpec.external_tools (“In-process only and not persisted”, meerkat-mob/src/runtime/handle.rs:1901-1902), the mob-wide default_external_tools_provider (ExternalToolsProvider Arc alias, meerkat-mob/src/lib.rs:186; meerkat-mob/src/runtime/builder.rs:54, 1984-1988), the actor default_llm_client override, and the surface-injected MobToolsFactory/schedule/workgraph dispatchers (meerkat/src/service_factory.rs:854-874; Arc fields on AgentBuildConfig, meerkat/src/factory.rs:346-424, 468-500).
• The compiler consumes definition-level material beyond the Profile: definition.skills content for referenced names (build.rs:517-550 — SkillSource::Path is read from the building host’s filesystem, fail-closed at 530-538, wasm32-rejected at 540-543), definition.models (build.rs:298; meerkat-mob/src/definition.rs:598-605), definition.image_generation_provider (build.rs:303-305), and definition.profiles.keys() for default spawn-profile grants (build.rs:249-271).
• The existing machine digest under-covers cross-host build identity: skills_digest hashes skill NAMES only (meerkat-mob/src/runtime/spawn_profile_authority.rs:49) and nothing digests definition.skills content, definition.models, the spawn overlay, or the assembled prompt (meerkat-machine-schema/src/catalog/dsl/mob_machine.rs:187-198). “Same digest” does not imply “same agent” across hosts today.
• Prompt gap (historical implementation note): a skill-less profile with no spawn override left SystemPromptOverride::Inherit, which resolved through the building host’s prompt sources. The session contract does not persist or reconcile a singleton current prompt: each System is an ordinary ordered transcript message. Rematerialization authors nothing. New System content uses the typed session or mob System-context admission API after resume.
• Profile MCP servers (McpServerConfig: stdio {command,args,env} / http {url,headers}, meerkat-core/src/mcp_config.rs:41-64) are materialized into a session-owned router at build (factory.rs:4667-4701; feature-absent builds fail closed at 4702-4710). A missing stdio binary does not fail the build: the failure arrives asynchronously as typed PendingFailed → McpLifecyclePhase::Failed (meerkat-mcp/src/router.rs:1488-1508, 1668-1745). wait_for_mcp defaults false and the mob compiler never sets it (zero hook/wait_for_mcp hits in build.rs — NOT FOUND).
• Hooks are host config, not profile vocabulary: hook_engine_override else layered {active > context > user} .rkat/config.toml (factory.rs:5090-5114; meerkat/src/sdk.rs:80-129). Profile has no hooks field (profile.rs:162-251 — NOT FOUND).
• Memory is host-realm-local and session-scoped: HnswMemoryStore::open(store_path/"memory"), MemorySearchScope::for_session(session_id), fail-closed CapabilityUnavailable when enabled-but-unavailable including feature-absent builds (factory.rs:5636-5697).
• Models: the catalog is compiled into the binary (meerkat_models::canonical(), meerkat-models/src/catalog.rs:142-156), merged per build with custom_models (factory.rs:3870-3879). Provider credentials resolve entirely host-locally (ResolverEnvironment::with_process_env + TokenStore + realm binding candidates + ProviderRuntimeRegistry.resolve, factory.rs:3961-4011); AuthBindingRef is a structural name-ref carrying zero credential material (meerkat-core/src/connection.rs:216-235). The RKAT_TEST_CLIENT=1 env shim exists on whichever host runs the build (factory.rs:3922-3927).
• Comms envelopes are Ed25519-signed, not encrypted: no tls/noise/encrypt/cipher/aes/x25519 primitive exists anywhere in meerkat-comms/src (grep NOT FOUND). Anything placed in a materialize payload transits signed-plaintext TCP.
• Both agent-facing mob tool surfaces are in-process on the controlling host: MobOperatorToolDispatcher holds MobHandle (tools.rs:341-346; twelve operator tools at :358-519; per-call spawn-scope re-check at :865-872) and mob-mcp’s AgentMobToolSurface holds Arc<MobMcpState> (meerkat-mob-mcp/src/agent_tools.rs:103, 417). No member→controlling-host command path exists over comms at HEAD — the prior draft’s claim that delegation “already travels via comms” is false; this subsection adds that lane (R6).
• Per-turn injected_context already crosses hosts end-to-end: BridgeDeliveryPayload.injected_context (meerkat-mob/src/runtime/provisioner.rs:3378) lowers as InjectedContext-role appends before the peer append (meerkat-runtime/src/comms_drain.rs:818-821). No new work; MobKit’s mob/turn_start / mob/submit_work lane is placement-agnostic as shipped.

​

15.2 Decisions

​

15.3 PortableMemberSpec (contracts; deny_unknown_fields; every field enumerated against BuildAgentConfigParams build.rs:92-126, SpawnMemberSpec handle.rs:1844-1907, and the actor post-mapping actor.rs:9227-9235)

PortableMemberSpec {
  mob_id, profile_name, agent_identity,          // comms_name/realm re-derived member-side via the
                                                 // single owners (MemberCommsName, meerkat_core::mob_realm_id
                                                 // — connection.rs:261; build.rs:24-34,172-184)
  profile: Profile,                              // fully resolved: realm-ref/override_profile/inherited-filter
                                                 // category-opening applied; portability-validated (R5/R6:
                                                 // rust_bundles empty, mcp allowlist empty, mcp_servers env/headers empty)
  definition_extract: {
    models: BTreeMap<String, CustomModelConfig>,             // definition.rs:598-605
    image_generation_provider: Option<Provider>,             // definition.rs:606-611
    skills: BTreeMap<String, SkillSource>,                   // referenced names only; Path resolved to Inline
                                                             // controlling-host-side, read failure fails the
                                                             // spawn closed (build.rs:530-538 precedent)
    profile_names: Vec<String>,                              // for default spawn-profile grant parity checks only;
                                                             // authority itself ships minted (below)
  },
  overlay: {
    context, labels, additional_instructions,
    system_prompt: SystemPromptOverride,                     // never Inherit (R3)
    tool_access_policy: Option<ToolAccessPolicy>,            // never Inherit (build.rs:338-341 discipline)
    mob_tool_authority_context: Option<WireMobToolAuthorityContext>, // sealed-type wire PROJECTION; minted by the controlling host, shipped for
                                                             // member-side visibility composition (the documented
                                                             // rehydration lane, build.rs:103-110); dispatch
                                                             // authority re-resolved controlling-host-side (R6)
    auth_binding: Option<AuthBindingRef>,                    // name-ref only; zero credential material (D3)
    budget_limits: Option<BudgetLimits>,                     // split computed controlling-host (§7.3); seed rides
                                                             // the MaterializeMember payload as already specified
    runtime_mode: MobRuntimeMode, continuity_intent,            // launch mode is NOT here: owned solely by
                                                             // MaterializeMember.launch {Fresh|Resume} (A6)
    resume_override_mask semantics: profile.resume_overrides apply against the DURABLE SPEC as profile truth
                                                             // (7.6.7)
  }
}

​

15.4 Machine deltas (catalog DSL; extends §6.1/§6.3)

• New field spawn_profile_authority_resolved_spec_digests: Map<AgentIdentity, Option<String>>; AuthorizeSpawnProfile input and SpawnProfileAuthorized effect gain resolved_spec_digest: Option<String> (exact-match echo extends require_authorized_effect, spawn_profile_authority.rs:86-121). Invariant: remote placement ⇒ Some before Spawn admits.
• ResolveSpawnMemberAdmission (§6.1) gains the portability validation — and placement/portability admission is enforced INSIDE the machine spawn-exec ladder at enqueue_spawn’s BeginSpawnExec opener, the one choke-point every spawn path crosses (agent tools, RPC mob/spawn*, embedder MobHandle::spawn_spec — the RPC/embedder paths bypass the tool-seam admission today, meerkat-mob-mcp/src/lib.rs:978-984; A4): typed reject causes NonPortableResource { kind: RustBundles | PerSpawnExternalTools | MobDefaultExternalTools | DefaultLlmClientOverride | HostSurfaceMcpAllowlist | WorkgraphTools } and SecretBearingField { field: ShellEnv | McpStdioEnv | McpHttpHeaders }, alongside §6.1’s MissingHostCapability. Schedule tools are portable under A3-final/§18.5: session-target schedules remain host-local and member-side mob-target schedules fail typed at fire.
• HostCapabilityFlags (§6.1) gains memory_store, mcp, engine_version.
• Invariants: RequestMemberMaterialization.spec_digest = the authorized resolved digest for that identity; CommitSpawnMembership (remote arm) requires the ack-echoed spec_digest to equal it and records the echoed engine_version; ack engine_version ≠ bound host_capabilities.engine_version ⇒ typed HostEngineVersionChanged materialize failure feeding rebind.

• Materialized-members value extends to { generation, fence_token, session_id, spec_digest }.
• New input ResolveMaterializePreflight { agent_identity, generation, fence_token, spec_digest, observations: MaterializePreflightObservations } → effects MaterializeAdmitted / MaterializeRejected { cause } (dispositions declared for seam-inventory). Observations are shell-read facts (binary lookup, registry resolve outcome, realm backend probe) fed typed into the authority — the authority decides, the shell observes (RMAT read-seam discipline).
• Dedup extension: same (identity, generation, fence) + same spec_digest ⇒ replay returns the recorded result; same tuple + different digest ⇒ typed SpecDigestMismatch (one idempotency key can never name two builds).
• Persistence: the host-side SQLite row gains the spec bytes + digest + engine-version-at-build (7.6.7).

​

15.5 Wire deltas (meerkat-contracts; V4; regen-schemas/SDK/parity gates apply)

• PortableMemberSpec as §15.3 (deny_unknown_fields); MaterializeMember.spec becomes this type.
• MemberMaterialized gains spec_digest: String, engine_version: String.
• BridgeCapabilities gains memory_store: bool, mcp: bool, engine_version: String.
• BridgeRejectionCause gains ModelUnresolvable { model }, AuthBindingUnresolvable { realm, binding }, McpCommandMissing { server }, RealmBackendUnavailable, SpecDigestMismatch, HostEngineVersionChanged (typed only; bridge-classifier gate applies, and every new BridgeReply consumer joins BRIDGE_CLASSIFIER_FILES per Gotcha #1).
• New supervisor-addressed payload family over the supervisor.bridge intent: MemberOperatorRequest { agent_identity, requester_generation, requester_fence_token, request_id, op: MemberOperatorOp } / MemberOperatorReply — MemberOperatorOp is a closed enum mirroring the twelve operator tools (tools.rs:358-519). Direction is member-host → controlling host. The member runtime samples its current host binding stamp once per logical request; every transient resend is byte-identical, including generation, fence, request id, and operation. Admission is MACHINE-owned (A8): ResolveMemberOperatorAdmission { agent_identity, requester_generation, requester_fence_token, sender_peer_id, request_id } requires the signed generation+fence to equal the current identity binding, then checks roster peer-key binding, placement presence, and non-revoked host. A delayed envelope from a prior incarnation therefore rejects StaleGeneration/StaleFence even when Resume reused the same session and peer key. Only after admission does the shell read the generation-pinned authority-facts record and re-mint the sealed agent context; no authority claim rides the wire. Idempotency is durable and fail-closed. The responder atomically inserts Pending { op_digest } under (mob_id, agent_identity, requester_generation, requester_fence_token, request_id) before any effect. Same key + different digest is a stable request conflict and never overwrites the original. A matching immutable Terminal { reply } replays verbatim across reply loss and controlling-host restart. A recovered or concurrently observed Pending is never execution authority: it CAS-terminalizes to explicit upcall_indeterminate and is not re-executed (including SpawnMember, SpawnManyMembers, and MobRunFlow). The actual completed reply is sent only after its terminal CAS succeeds or a durable terminal winner is reloaded. If terminal persistence fails after the effect, the caller receives non-success and the row remains Pending; the next delivery converges to the stable indeterminate terminal. If the initial Pending insert fails, no effect ran and the rejection is explicitly retryable. There is no capacity eviction; mob destroy is the sole scrub boundary. Reply-budget exhaustion on the member side remains typed upcall_timeout.

​

15.6 Preflight protocol and failure semantics (extends §9)

​

15.7 Durability and revival on the member host

​

15.8 v1 non-goals (typed degradation, never silent)

​

15.9 Phase assignments (§10)

• Phase 1 (catalog + contracts): §15.4 DSL deltas (resolved-spec digest field/input/effect echo, admission portability causes, HostCapabilityFlags extension, MobHostBindingAuthority preflight input/effects with dispositions), §15.5 wire types (PortableMemberSpec, ack echo fields, rejection causes, MemberOperatorRequest/Reply + MemberOperatorOp). TLC bounds unchanged (2 hosts × 3 members).
• Phase 2 (host bind): capability advertising (memory_store, mcp, engine_version) in the bind ceremony reply; recorded via CommitHostBind.
• Phase 3 (placement + materialization): the spec compiler on the controlling host (Path→Inline resolution, R3 prompt base resolution, authority mint + durable record), member-side preflight ladder + dedup, durable spec row + revival recompose, portability/secret admission rejects, and the member-operator upcall lane — it gates this phase’s own exit criterion (B2→B21/B22 on Host B).
• Phase 5 (scopes): pin the lane separation — member upcalls stay generated-authority-adjudicated; principal grants neither gate nor are satisfied by them (one owner per fact).
• Phase 6 (events): MCP Failed lifecycle visibility for remote members falls out of the pump; no additional work beyond §7.4 itself.
• Phase 7 (surfaces): mob/member_status MCP/tool-surface parity fields for remote members ride the existing projection work; rkat mob host surfaces preflight results in host status output.

​

15.10 Tests (extends §11; deterministic lanes are the ratchet)

​

16. Live channels (realtime) for remote members

Scope: the live/* realtime plane (audio/text live channels) for mob members whose sessions live on a member host. The v4 plan text was previously silent on this plane — live/* appears nowhere in §§1-13. This section closes that gap without re-litigating D1-D6.

​

16.0 Verified substrate (what exists, what fails today)

• Live is an RPC-process-only surface: rkat-rpc flags --live-ws / --live-ws-scheme / --live-tool-timeout-ms (meerkat-rpc/src/main.rs:53-81); every live/* dispatch arm is registered only when a transport is attached (live_enabled(), meerkat-rpc/src/router.rs:1064-1079; arms :1958-2077; pinned by assert_no_live_methods, router.rs:10232-10240). REST mounts no live endpoints; the CLI has no live wiring (NOT FOUND outside meerkat-live + rkat-rpc main).
• live/open resolves the target session strictly process-locally: the B17 gate runtime.session_state() consults staged sessions + the local SessionService list and returns INVALID_PARAMS "session {id} not found" otherwise (meerkat-rpc/src/handlers/live.rs:871-886 over meerkat-rpc/src/session_runtime.rs:6902-6948). A console live/open against a remote member’s session fails today at this gate — and that behavior is correct under §3 (realms are not distributed; the session genuinely does not exist in the controlling host’s realm). We do not “fix” live/open; we add an identity-addressed mob surface (DL3).
• The bootstrap indirection is already designed: LiveOpenResult.transport carries WireLiveTransportBootstrap::Websocket { url, token } with an absolute URL (meerkat-contracts/src/wire/live.rs:155-206), built as "{base_url}{LIVE_WS_PATH}?token=..&channel=..&format=.." (handlers/live.rs:1196-1202) where base_url = "{scheme}://{listener.local_addr()}" (main.rs:511-519). SDK clients connect that URL directly — the SDK deliberately does not own the WS transport (sdks/typescript/src/client.ts:3073-3080).
• Channel binding + one-active-channel-per-session are owning-session MeerkatMachine facts (live_active_channel_by_session / live_channel_session_by_channel, meerkat-machine-schema/src/catalog/dsl/meerkat_machine.rs:2726-2760; ResolveLiveOpenAdmissionAccepted guards session_not_active/channel_not_bound, dsl:17402-17421). WS bearer tokens are machine-adjudicated in the same session’s machine: mint via RecordLiveWebsocketTokenIssued, single-use/TTL/channel-pinned admission via ResolveLiveWebsocketTokenAdmission (dsl:17981-18069; TOKEN_TTL = 60s, meerkat-live/src/transport.rs:57).
• The WS wire protocol carries only typed input inbound (Text = LiveInputChunkWire, Binary = negotiated pcm_24k_mono) and observations outbound (transport.rs:5-33). The control verbs (commit_input, interrupt, truncate, refresh, close, status) exist only as RPC methods (router.rs:1987-2077).
• Realtime gates evaluate on the process that owns the session: B19 ModelNotRealtime from the catalog realtime flag (meerkat/src/session_runtime/live_orchestration.rs:46-70; exactly one catalog row is realtime: true — gpt-realtime-2, meerkat-models/src/capabilities/openai.rs:312); B18 provider-adapter support is factory-owned (OpenAiRealtimeSessionFactory::supports_provider == Provider::OpenAI, meerkat-openai/src/live.rs:3043-3050; #302 no-factory fail-closed check, handlers/live.rs:888-901). Realtime credentials resolve per open from the owning process’s realm config chain (meerkat-rpc/src/live_wiring.rs:25-38, wired at main.rs:376-390); the factory holds no credential material.
• Live observations project into the owning session’s canonical stores via the mandatory projection sink (main.rs:401-436; LiveAdapterHost requires the sink at construction, meerkat-live/src/host.rs:1535-1546), so live-derived transcripts/status land in the owning host’s session/EventStore.
• The supervisor bridge has no live/audio/realtime commands (BridgeCommand, meerkat-contracts/src/wire/supervisor_bridge.rs:238-251 — NOT FOUND for any streaming/media variant) and the bridge client is single-flight (request_lock, meerkat-mob/src/runtime/supervisor_bridge.rs:35-49). meerkat-live has no production WS client (the only tokio_tungstenite::connect_async hits are inside mod tests, transport.rs:928+; the sole outbound WS client in the workspace is the OpenAI adapter’s provider connection).
• live/open already anticipates mob-owned sessions locally: ensure_live_peer_ingress skips session-owned drain reconfiguration when peer_ingress_owner.is_mob_owned() (meerkat-rpc/src/session_runtime.rs:4344-4365, skip at :4357).
• The --live-ws bind bypasses TcpBindPolicy: validate_tcp_bind_policy is applied only to --tcp (main.rs:184-194); the live-ws listener binds any address unconditionally (main.rs:462-469) and is plaintext (wss is advertisement-only for a TLS-terminating proxy, main.rs:75-81).

​

16.1 Decisions

​

16.2 Observation parity (nothing new to build)

​

16.3 Machine deltas (catalog DSL; amends §6)

• §6.1 MobMachine — one new field: host_live_endpoints: Map<HostId, LiveWsEndpointUrl> (sealed newtype over a scheme-qualified ws|wss absolute base URL; ctor validates scheme+shape). Populated/refreshed only by the existing CommitHostBind / HostRebound inputs (payloads gain the optional endpoint); cleared by RevokeHost. No new inputs, no new effects. Invariants: keys(host_live_endpoints) ⊆ { h ∈ mob_hosts : host_bind_phase[h] = Bound }; rebind without the endpoint clears the entry (capability is re-declared each bind, per D5’s restart-truthfulness rule).
• §6.4 MeerkatMachine — member-addressed admission classification coverage for the four new commands (OpenMemberLiveChannel, CloseMemberLiveChannel, MemberLiveChannelStatus, ControlMemberLiveChannel) in ResolveSupervisorBridgeCommandAdmission; the typed command manifests (runtime_alphabet_parity) force this. Fence posture matches the rest of the member-addressed family in v1: supervisor identity + epoch on delivery, supervisor-side StaleFenceToken on submit (§6.4’s recorded status quo — no new member-side fence check is smuggled in here).
• §6.5 / §8 MobMachine grants — ControlScope vocabulary gains Live; flows through the existing GrantOperatorScopes / RevokeOperatorScopes inputs and the sealed policy unchanged (data extension, no machine-shape change).
• Owning-side live authorities: explicitly unchanged. ResolveLiveOpenAdmission*, RecordLiveWebsocketTokenIssued, ResolveLiveWebsocketTokenAdmission*, refresh/close/command authorities (dsl:17402-18069) run on the owning host exactly as shipped. The controlling host never mints or validates live tokens and holds no channel map — remote channel status is a proxied point read, not a projection cache. MobHostBindingAuthority (§6.3) gains nothing: live commands are member-addressed (DL2).

​

16.4 Wire deltas (meerkat-contracts; rides the §7 V4 protocol bump)

• OpenMemberLiveChannel(BridgeLiveOpenPayload { supervisor, epoch, protocol_version, turning_mode: Option<RealtimeTurningMode>, transport: Option<LiveOpenTransport>, seed_max_chars: Option<usize> }) — mirrors LiveOpenParams minus session_id (wire/live.rs:123-129; identity addressing replaces it).
• CloseMemberLiveChannel(BridgeLiveChannelPayload { supervisor, epoch, protocol_version, channel_id })
• MemberLiveChannelStatus(BridgeLiveChannelPayload)
• ControlMemberLiveChannel(BridgeLiveControlPayload { supervisor, epoch, protocol_version, channel_id, verb: BridgeLiveControlVerb }) with BridgeLiveControlVerb = CommitInput | Interrupt | Truncate(mirror of live/truncate params) | Refresh.

​

16.5 Member-host live composition (amends D6 role recipe)

​

16.6 Failure semantics (amends §9 table)

​

16.7 Phase placement (amends §10)

• Phase 1 additions: §16.3 catalog deltas (bind-payload endpoint field, §6.4 classification coverage, ControlScope::Live) + §16.4 contracts (commands, replies, causes, console DTOs) in the same change-sets.
• Phase 2 additions: host-role live composition (§16.5); --live-ws-advertise; bind descriptor + ceremony carry the live endpoint; TcpBindPolicy gap closure in both binaries (DL7).
• Phase 5 addition: Live scope in the grant vocabulary + sealed-policy enforcement rows for the live verb family.
• New Phase 6b — Remote live channels (gated on phase 5 per §8’s ordering rule AND on phase 6’s deliverables — the §7.4 pump carries live observation parity (§16.2) and the bridge single-flight relaxation is what keeps live control verbs from serializing behind long-polls; 6b therefore lands AFTER phase 6, with only the LiveOrchestrator/sink extraction pre-work parallelizable): LiveOrchestrator pipeline extraction (DL4); member-host bridge responder arms; controlling-host proxy dispatch + placement branch + typed cause mapping; reply-loss reconciliation; BRIDGE_CLASSIFIER_FILES extension. Exit gates: the phase-wide machine/contracts gates plus the deterministic test rows below.
• Phase 7 additions: mob/member_live_* on RPC + generated SDKs (+ rkat mob live ... CLI verbs); REST/MCP remain intentionally absent per §17.2 SD-2/SD-4; surface-alignment gates.
• Phase 8: MobKit consumes the new surfaces; still no MobKit-owned live registry.

​

16.8 Test matrix additions (amends §11; deterministic lanes are the ratchet)

• V4 live command/reply/cause encode-decode + fail-closed decode on V2/V3 receivers; admission classification for all four commands (alphabet parity green)
• proxied open returns the owning host’s bootstrap verbatim: URL base = advertised URL (not local_addr), token minted by the owning session’s machine; direct WS connect to the member-host listener drives text+audio end-to-end against the scripted factory
• cross-host token misuse matrix: replay against wrong channel, expired token, double-consume, token minted by host A presented to host B — all fail closed
• duplicate proxied open → LiveChannelAlreadyBound; open on non-realtime model → ModelNotRealtime round-trip; open on live-incapable host → LiveTransportUnavailable with zero bridge traffic (asserted); webrtc-on-remote → LiveTransportUnsupported
• control-verb proxy: commit_input/interrupt/truncate/refresh round-trip and mutate the owning channel; long-poll pumps (phase 6) do not block live control verbs (single-flight relaxation covers both)
• scope matrix: Live grants exactly the live family; SendCommand+SubscribeEvents without Live → ScopeDenied{required: Live}; owner-implicit-full unchanged
• observation parity: transcripts projected by the owning sink arrive at the console via the §7.4 pump/pages — no live-specific event path exists (asserted by absence)
• reply-lost open: drop the bridge reply after owning-side open; status discovers the channel; close clears it; retry opens cleanly
• mob-owned-ingress skip holds for a host-materialized member on remote open (no drain reconfigure)
• bind-policy: non-loopback --live-ws without --allow-remote refused (both binaries); host role without --live-ws-advertise refused; advertise-URL newtype rejects non-ws/wss schemes
• pinning: live/* RPC methods still not advertised without a local transport (router.rs:10232-10240 stays green); live/open with a remote member’s session id still returns not-found (B17 unchanged)

​

16.9 Non-goals (v1) — typed degradation, never silent

• Remote WebRTC transport: LiveTransportUnsupported { requested: webrtc } typed reject at the controlling host. v2 seed: live/webrtc/answer signaling proxy over the bridge.
• Media relay through the controlling host: no relay path exists and none is silently substituted — an unreachable advertised URL surfaces as the client’s WS connect failure after a prompt typed-success open (never a hang, never proxied audio). v2 seed only if operator evidence demands it.
• Bridge-carried input/media frames: no SendInput bridge verb; the WS is the input plane on every placement. live/send_input remains a local-session RPC verb; for remote members’ session ids it honestly reports not-found in the controlling realm.
• In-process TLS termination: wss stays advertisement-only (main.rs:75-79); production posture is a TLS-terminating proxy fronting the member-host listener, recorded in the advertised URL’s scheme.
• mob/member_status live-channel enrichment: status assembly stays bridge-free; live channel state is the dedicated mob/member_live_status point read (avoids per-status bridge fan-out and any controlling-side channel cache).
• Agent-facing live delegation tools: NOT FOUND today (meerkat-mob-mcp/src/agent_tools.rs has no live tools) and none are added — live channels are a console/operator surface in v1; an agent asking for one gets the ordinary unknown-tool error. Live tool dispatch during a live turn is unaffected (owning-host RuntimeLiveToolDispatcher, unchanged).
• Cross-host token mint/validation: unrepresentable by construction — token state lives only in the owning session’s machine; there is no API through which the controlling host could mint one, so there is nothing to degrade.
• Aggregate cross-host live budget: per-session enforcement only, consistent with §7.3’s budget stance.

​

16.10 Implementer gotchas (extends §13)

11. The --live-ws bind-policy gap (main.rs:462-469 vs :184-194) is pre-existing; closing it changes standalone rkat-rpc behavior for non-loopback binds (now requires --allow-remote). Ship the change with its own release note; do not quietly fold it in.
12. The advertised live endpoint is a MobMachine bind fact — do not put it on RuntimeHostInfo (anti-authority pin, wire/host.rs:181-210).
13. live/open’s B17 not-found for remote session ids is correct; the fix is the identity-addressed mob surface, never a placement branch inside live/*.
14. MemberLiveChannelOpened must embed LiveOpenResult (contracts-owned, wire/live.rs:155) rather than re-declaring fields — one wire shape for local and remote opens, and the Unknown{debug} transport floor (wire/live.rs:190-206) rides along for free.
15. Every new BridgeReply consumer file goes into BRIDGE_CLASSIFIER_FILES (xtask/src/bridge_classifier.rs:27-31) — the mob live proxy is a new consumer by construction.
16. The deterministic realtime fake lives in meerkat-openai/tests today (mock_realtime_ws); the cross-host lanes need it as a shared fixture — budget the lift, don’t copy-paste the mock.

​

17. Surface consequence matrix — RPC / REST / MCP-server / agent tools / SDKs / WASM / CLI

Referenced by phase 7 (§10). Doctrine for this section: surfaces stay thin skins over SessionService/MobHandle. Remote coverage lands UNDER existing methods wherever AgentIdentity already keys the API — there are no parallel “remote-flavored” verbs. Only genuinely new nouns (hosts, grants, route installs, member history) get new methods, and those register in the generated catalogs so every ratchet fires. Every mob surface change falls into exactly one of three consequence classes: (a) transparently remote (zero wire change; placement resolves behind the existing method), (b) new noun (full catalog cascade), (c) structurally untouched (asserted, so drift into it is reviewable).

​

17.1 Class (a): transparently remote — zero wire change

​

17.2 Class (b): new nouns — decisions (each fork closed)

​

17.3 Class (c): structurally untouched (asserted)

​

17.4 Typed error rendering across surfaces

​

17.5 SDK consequences (TS / Python / web)

• TS + Python: Mob.member_history() wrapper (+ hosts(), route_installs(), bind_host(), revoke_host(), grant_scopes(), revoke_scopes(), grants()) — forced by the wrapper gate the moment the catalog entries land (SD-6). No SDK Mob class has any history method today (NOT FOUND in sdks/web/src/mob.ts, sdks/typescript/src/mob.ts, sdks/python/meerkat/mob.py).
• Generated types: all three generated/ dirs regenerate (scripts/verify-sdk-codegen-freshness:11-15); no new WireEvent types means verify_sdk_event_inventory does not fire (SD-5).
• Released-SDK compat: every touched DTO extension is optional + skip_serializing_if. The web SDK’s closed-key parsers (requireOnlyKeys, sdks/web/src/mob.ts:96-107) guard exactly the spawn-response entry shape (:466-495) and event-source shapes (:514-548) — neither shape is touched by this plan’s wire deltas; MobMemberStatusResult is parsed tolerantly by named fields. Rule recorded: any future field on a requireOnlyKeys shape must update the web SDK parser in the same change or released browsers throw on contract-valid payloads.
• Web SDK is console-only and RPC-free: sdks/web/src must stay free of RPC-shaped method literals (scripts/verify_rpc_surface_alignment.py:27-29). Its multi-host work is generated-type regeneration plus the handwritten placement/status and spawn-response parsers needed for those generated contracts; it still gains no RPC console methods. No bind_host/grant/member-history additions to the web Mob class in v1 — the browser observes only what the embedded runtime owns.

​

17.6 WASM / browser runtime

• Typed placement reject (phase 3, with the field itself): mob_spawn parses specs_json in-browser (lib.rs:2077); when a spec carries placement, it returns a typed unsupported-capability error (D5 doctrine: typed degradation, never silent strip). Silently ignoring placement would be the exact silent-cap pattern §6.5 kills for event streams.
• No host exports: mob_bind_host/grant/member-history wasm exports are not added; browser mobs are declared single-host in §17.12.
• Compile-time obligation: every new contracts type (HostRef, cursors, host DTOs, error codes) must stay wasm32-clean — wasm-check runs on every code change and wasm-contract on contracts/web paths (.github/workflows/cargo.yml:518-541).

​

17.7 CLI

• Phase 2 (ceremony operability): rkat mob host daemon (D6) — flags --identity-dir, --listen-tcp, --advertise-tcp, --descriptor-out, reusing the shipped rkat run acceptor flag family and descriptor mechanics (--comms-listen-tcp/--comms-binding-out, meerkat-cli/src/main.rs:1727-1790) with the host-flavored descriptor {kind: "host", address, public_key, bootstrap_token} (§7.2). Plus the controlling-side ceremony verbs rkat mob bind-host <mob> --descriptor <file>, rkat mob revoke-host, rkat mob hosts — the CLI drives mob APIs in-process, so these can precede the RPC methods and make the phase-2 exit gate operable end-to-end.
• Phase 5: rkat mob grant, rkat mob revoke-grant, rkat mob grants (land with enforcement; owner-implicit-full-scope keeps single-user CLI behavior unchanged, §8).
• Phase 7: rkat mob member-history <mob> <identity>, rkat mob route-installs <mob>.
• Unchanged verbs (remote-covering for free): MemberStatus, ForceCancel, Respawn, Logs, Attach, Status, WaitKickoff, SpawnHelper, ForkHelper (main.rs:2666-2890 — no host/grant/member-history verbs exist today, NOT FOUND in the MobCommands enum; grant has zero hits in main.rs).
• New exit codes 45-48 require NEW WORK, not an existing seam: ErrorCode::cli_exit_code() has zero consumers in rkat today (the binary exits EXIT_SUCCESS=0 / EXIT_ERROR=1 / EXIT_BUDGET_EXHAUSTED=2, main.rs:89-91, and mob handlers anyhow-stringify). Phase 7 adds a typed MobError → ErrorCode → exit path for the mob verb family; the pre-existing EXIT_BUDGET_EXHAUSTED=2 vs cli_exit_code(BudgetExhausted)=21 inconsistency is recorded and NOT silently changed for non-mob verbs.

​

17.8 Member-host surface posture (stated, non-contractual)

​

17.9 CI gate cascade per addition class

​

17.10 v1 non-goals for surfaces (typed degradation, never silent)

• REST admin (bind/revoke host, grant/revoke): not served; recorded NOTE: in rest_catalog.rs (SD-2). Absent path = honest 404 by documented intent, not phantom catalog entry.
• MCP host/grant admin tools: absent from the roster; unknown tool names fail closed as unknown tools (mcp-server lib.rs:1824-1870). Symmetry may return post-v1 behind proven AdminHost scope.
• Browser mobs are single-host: placement-bearing spawns get a typed unsupported reject in meerkat-web-runtime; no host/grant wasm exports; no RPC literals in sdks/web (gate-enforced).
• No direct observer→member-host endpoints (restates D2); consoles always talk to the controlling host.
• No new MCP alignment gate in v1: in-process roster parity is the enforcement; docs/api/mcp.mdx is a named hand-update.
• Member-host local surfaces non-contractual (§17.8): visible sessions are a realm-local side effect, typed-undefined for mutation, never advertised.
• No aggregated cross-mob host registry endpoint: hosts are per-mob MobMachine facts; mob/hosts is mob-scoped. A fleet view is a MobKit projection concern.
• No mobpack-manifest placement capability (CapabilityId untouched); packs that need placement fail closed at spawn admission with the §7.3 typed reject, not at pack load.

​

17.11 Surface test additions (lane-mapped; deterministic lanes are the ratchet — e2e-system/e2e-smoke do not run in GitHub CI)

​

17.12 Surface gotchas (append to §13)

14. verify_sdk_wrapper_freshness requires the method literal in hand-written SDK source — generated mirrors do not count (verify_rpc_surface_alignment.py:20-24). Budget real wrappers, not codegen output.
15. REST catalog entries and router() arms must land in the same change (phantom-404 precedent, rest_catalog.rs:174-181).
16. MCP has no external alignment gate — the roster tests catch dispatch drift, but docs/api/mcp.mdx drift is caught by nobody; it is a named phase-7 work item.
17. external_member: Option<Value> on MobMemberStatusResult is a folklore trap — placement/reachability go in the typed fields only (SD-5 pin test).
18. The web SDK’s requireOnlyKeys shapes are breaking-on-extend for released browsers — check every touched DTO against sdks/web/src/mob.ts:466-548 before adding fields.

​

18. Orchestration-adjacent systems: flows, workgraph, schedules, approvals, tool policy, budget, taint

Scope: how every orchestration-adjacent subsystem behaves when a mob spans hosts. Builds on D1–D6 (settled). Decisions in this section are numbered O1–O8. Every “today” claim is anchored at HEAD (0.7.22 / da467fca8).

​

18.1 Flows across remote members (O1, O2)

• BridgeDeliveryPayload gains one additive optional field: turn: Option<BridgeTurnDirective { correlation: { run_id, step_id }, tool_overlay: Option<WireTurnToolOverlay> }> (absent-omitted, the injected_context byte-compat precedent, meerkat-contracts/src/wire/supervisor_bridge.rs:852-859). Silent overlay drop is structurally impossible: the payload is deny_unknown_fields (:844), so a pre-V4 receiver rejects a directive-bearing delivery at decode — a typed BridgeCommandRejected step failure, never a turn that runs ungated. Directive-bearing deliveries require protocol V4.
• Member-side, a directive-bearing delivery is admitted as a tracked turn: TurnDriven members admit through the host’s session turn admission carrying StartTurnRuntimeSemantics { handling_mode, tool_overlay } and a host-local event_tx — the local TurnDriven mechanics relocated to the host that runs the loop; AutonomousHost members admit via inject_with_subscription. Overlay + AutonomousHost stays typed-rejected regardless of placement (same seam limitation on every host).
• Dispatch disposition becomes machine-owned: new MobMachine input ClassifyFlowStepDispatch { run_id, step_id, target, overlay_present } → effect FlowStepDispatchClassified { dispatch: Local | RemoteTurnDirective | RejectedOverlayAutonomous | RejectedHostIncapable }, adjudicated against machine-owned facts ONLY: the guard reads self.member_runtime_modes[target] (machine state written at CommitSpawnMembership), self.member_placement, and self.host_capabilities — runtime mode is NEVER a shell-supplied input (a roster-cache claim would be shadow truth on the exact seam this decision promotes to machine ownership); overlay_present is the one legitimately shell-observed request fact (the ClassifyTurnTimeoutDisposition shape). The executor consults it before any delivery, so an unsupported combination fails the step typed at dispatch instead of surfacing as today’s mid-run UnsupportedForMode. A run-open whole-flow sweep is deliberately rejected: role→member resolution happens at dispatch and membership mutates mid-run — a sweep would fabricate certainty; per-dispatch classification is the honest gate.

• At directive admission, the member host atomically creates the per-turn subscription (the remote twin of the admission-time atomicity at actor_turn_executor.rs:299-316/:334-365 — today’s receiver discards the completion handle, meerkat-runtime/src/comms_drain.rs:2701) and, at terminal, records (agent_identity, generation, input_id) → RecordedTurnOutcome { terminal_seq, outcome } durably in MobHostBindingAuthority (§6.3).
• BridgeReply::MemberEventsPage (§7.4) gains a bounded turn_outcomes: Vec<BridgeTurnOutcomeRecord { input_id, generation, terminal_seq, outcome }> page plus outcomes_complete; PollMemberEvents carries the exact prior-page (generation, input_id) acknowledgements and an independent max_outcomes. terminal_seq is pinned to the durable StoredEvent.seq domain (never the session-task or per-stream counters, gotcha 8). The host prunes only acknowledged durable rows; unknown/already-pruned acknowledgements are no-ops and create no negative memory. Lost replies replay unacknowledged rows, while a delayed journal commit remains visible on a later page. Both one-record admission and the combined encoded reply are byte-bounded below transport MAX_PAYLOAD_SIZE: each failed terminal carries detail: { text, original_utf8_bytes, truncated }, and the member host retains the largest UTF-8 prefix that keeps the complete journal row at or below 64 KiB before record_turn_outcome. Pathological input-id framing that cannot leave room even for an empty detail is rejected before runtime acceptance; an accepted turn is never rejected after its effect because its provider detail was large. The terminal discriminant, exact acknowledgement key, and original UTF-8 byte length remain unchanged/typed. Retention is also hard-bounded while a controller is offline: each member admits at most 256 retained-plus-in-flight directed outcomes (at most 64 KiB each). The 257th directive rejects before runtime acceptance with typed OutcomeJournalFull { retained, limit }; no unacknowledged completion authority is evicted. Hosts without durable_sessions never receive directives at all (RejectedHostIncapable at dispatch classification), so the field is always well-defined. The controlling host’s poll pump (one loop, one command — no second path) feeds outcome records to the remote flow ticket registry; unattributed event rows keep flowing to the merged stream for display. If an immutable terminal event row itself exceeds the bridge page budget, the pump advances that exact typed omission and resolves failed turns from the bounded sidecar instead of waiting for the ordinary turn timeout.
• Pump lifecycle is decoupled from observation (A17): dispatching a directive-bearing delivery records a MobMachine obligation pending_remote_turn_outcomes: Set<(AgentIdentity, InputId)> (recorded at FlowStepDispatchClassified{RemoteTurnDirective} realization, resolved when the pump consumes the outcome record or the timeout ladder disposes the step). The pump for a member runs while EITHER an event subscription is authorized OR obligations are outstanding — a flow step never depends on a console watching (the Rule-8 dropped-observation shape is unrepresentable).
• Terminal classification is extracted into a single shared meerkat-core turn-terminality classifier consumed by both the local executor bridge (actor_turn_executor.rs:98-217) and the member-host journal writer. WHY: two hand-maintained terminal-event lists are exactly the split-terminality failure shape; one authority, zero divergence window.
• Semantics: keyed on (generation, input_id) — redelivery converges on the one journal row; a generation bump (rematerialize) scopes the journal, so an old generation’s outcome can never attribute to a new turn and the step fails typed on generation change. Member-host restart mid-turn: the turn is dead, no record ever appears, and the step resolves through the existing timeout ladder (machine-owned disposition) — typed, honest. A directive-bearing delivery the member runtime cannot host as a tracked turn is rejected at admission with new cause TurnDirectiveUnsupported (extends #[non_exhaustive] BridgeDeliveryRejectionCause, supervisor_bridge.rs:885-896).

​

18.2 Tool access policy: Inherit locality and the sealed wire form (O3)

• MaterializeMember.spec.tool_access_policy: Option<WireResolvedToolAccessPolicy> where WireResolvedToolAccessPolicy = AllowList(names) | DenyList(names) — Inherit is unrepresentable at decode; None = unrestricted (host authority). Decode-time rejection is the only sound gate given build.rs:332-341; the member-host factory’s UnresolvedInherit seal (factory.rs:5421-5432) remains the backstop, and the member host persists the received policy into its own SessionMetadata.tooling.tool_access_policy so B21-spawns-B211 inherits correctly on Host B with zero controlling-host involvement.
• Member-host-originated spawn requests ride the ONE member-upcall lane — MemberOperatorRequest (§15, exact-generation/fence machine admission plus durable request-id ledger; A8: there is exactly one member→controlling command family, and this is it) — carrying two separate facts: requested_tool_access_policy_present: bool (the admission fact computed at the tool seam from the agent’s args and checked through the re-minted generated agent authority) and resolved_tool_access_policy: Option<WireResolvedToolAccessPolicy> (the resolution output). Principal ControlScope grants are not consulted on this lane (§15.2). WHY: resolving Inherit on Host B yields an explicit policy the agent never requested; deriving the privileged-presence fact from the resolved spec would launder an inherited policy into a stronger authority demand (or worse, the inverse). Two facts, two owners, no laundering.
• Containment invariant (tested both directions): a restricted parent on Host B spawning onto Host B or Host A yields a child whose sealed gate equals the parent’s effective policy; no host pair produces an Inherit-derived unrestricted child.

​

18.3 Budget (O4)

• §7.3 sentence replacement: “Budget: the spawn’s budget_limits ride PortableSpawnOverlay.budget_limits inside the digest-covered spec; the member host applies them to CreateSessionRequest.build.budget_limits (the shipped with_spawn_budget_limits path, actor.rs:793-803) and enforcement is local to the member’s session (aggregate mob budget is a non-goal, §12). Budget-split vocabulary and payload-level budget siblings do not exist on the wire.”

​

18.4 WorkGraph (O5)

• The denial is guarded INSIDE the machine spawn-exec ladder at the BeginSpawnExec opener — the one choke-point every spawn path crosses (A4; the tool-seam-only ResolveSpawnMemberAdmission dispatch is bypassed today by RPC mob/spawn* and embedder MobHandle::spawn_spec, meerkat-mob-mcp/src/lib.rs:978-984, so guarding only there would leave the split-brain reachable). Input fact workgraph_required: bool is the EXPLICIT resolved profile.tools.workgraph assertion captured before inherited category opening. Explicit workgraph emits the merged SpawnMemberAdmissionResolved { admission: NonPortableResource { kind: WorkgraphTools } }; a remote spawn carrying the non-serializable inherited tool-visibility authority is hard-denied first as NonPortableInheritedToolFilter. No skill suppression logic is needed because neither rejected combination builds, and non_portable_disabled remains a typed empty record in v1. Upcall spawns are unaffected because MemberOperatorSpawnSpec carries no inherited-filter field.
• Degradation is operator-explicit: place the member locally, or set tools.workgraph = false on the remote profile (the member then preloads task-workflow per build.rs:227-229 — session-local builtin tasks, no cross-host semantics). v2 seed: a bridge-proxied workgraph service (controlling-host store as the single owner), designed only if a machine decision ever depends on shared work state.

​

18.5 Schedules (O6)

• rkat mob host (D6, phase 2) does spawn a schedule host: realm-local stores, real session-target delivery (member sessions may carry tools.schedule, build.rs:245-246, and their session-target schedules must fire on the host owning the session realm), NoopScheduleMobHost, and no runnable registry in v1. A mob-target schedule created on a member host fails typed at fire (probe Missing → MarkMisfired per the MissingTargetPolicy default, types.rs:1138-1142; delivery MobRejected) — pinned as correct behavior, not fixed.
• HostRunnable host-locality is a typed invariant: the registry is process state; host_runnable targets never route across hosts; absent registry keeps failing TargetMissing. Pinned by test.
• Scheduled-helper containment: the captured creator policy is already resolved (the factory refuses to build with unresolved Inherit and persists resolved-only metadata — factory.rs:5421-5432/:5461-5463), so when a scheduled SpawnHelper/ForkHelper resolves to remote placement in phases 3+, the captured policy rides MaterializeMember as WireResolvedToolAccessPolicy unchanged — the same sealed-resolved rule as every other spawn (O3). No schedule-specific policy path.

​

18.6 Approvals (O7)

• v1 semantics: an approval record lives on the host whose RPC runtime created it. HostCapabilityFlags (§6.1) gains approval_forwarding: bool, advertised false by v1 member hosts at bind and projected to the console so remote members’ approval state is labeled unavailable, mirroring the D5 durable_sessions degradation pattern — typed capability, not silent difference.
• v2 seed (recorded so it is not re-invented): ApprovalOwnerRef::ExternalMember { mob_id, member_ref } (meerkat-core/src/approval.rs:169-172) + the Declared forwarding hooks are the reserved vocabulary; pulling it forward requires adding Approve to §8’s enum, bridge list/decide proxy commands, BRIDGE_CLASSIFIER_FILES entries, and placing decision authority on exactly the controlling host.

​

18.7 Outbound content taint (O8)

• A host-materialized member is the bridge case of the existing local-vs-bridge branch: provisioner_comms returns nothing (the member’s comms runtime lives on Host B), so the relay path applies — extend runtime_binding_for_entry/peer-spec derivation (actor.rs:12065-12072) to the new HostMaterialized { host } binding (peer = member pubkey @ host acceptor address, D1 demux). Admission classification is pinned member-addressed (member-side MeerkatMachine/comms-drain admission, exactly the shipped receiver) — never host-addressed; the taint fact is per-member.
• Ownership: the embedding application at the controlling host owns the outbound-taint fact for all mob members regardless of placement and is the only declarer; member hosts never self-declare, and the member host’s runtime keeps owning its own session-content bookkeeping as today. Lapse-on-rematerialize is the shipped, documented semantic (fresh context ⇒ no declaration, handle.rs:4838-4841) and stays symmetric across hosts: the embedder re-declares keyed on the member lifecycle signal (MemberMaterialized at the new generation, §7.3). The mob deliberately keeps no declaration cache to replay — that would be shell shadow state over an embedder-owned fact. Covered by an e2e-fast re-declaration test (§18.11).

​

18.8 Failure semantics (additions to §9)

​

18.9 Machine deltas (folds into §6; catalog first, dispositions and TLC bounds per §6 preamble)

• MobMachine — ClassifyFlowStepDispatch { run_id, step_id, target, overlay_present } input → FlowStepDispatchClassified { run_id, step_id, target, dispatch: Enum<FlowStepDispatchKind> } effect (Local | RemoteTurnDirective | RejectedOverlayAutonomous | RejectedHostIncapable), guarded on member_runtime_modes + member_placement + host_capabilities (all machine facts; RejectedHostIncapable covers a durable_sessions=false host — tracked turns need the durable outcome journal); disposition local seam SurfaceResultAlignment (the FlowFrameTerminalStatusClassified precedent, catalog mob_machine.rs:1412).
• MobMachine — ResolveSpawnMemberAdmission gains workgraph_required: bool + placement_remote: bool input facts and a Denied transition guarded placement_remote && workgraph_required, emitting MobSpawnMemberAdmissionKind::NonPortableResource { kind: WorkgraphTools } (merged vocabulary, A4), evaluated on the spawn-exec ladder choke-point.
• MobMachine — privileged_budget_split_policy_present deleted from the ResolveSpawnMemberAdmission input and both privileged-args guards (catalog mob_machine.rs:1997/:2018/:2031) as part of the O4 vocabulary removal.
• §6.1 field extension — HostCapabilityFlags gains approval_forwarding: bool (v1 member hosts advertise false).
• MobHostBindingAuthority (§6.3) — new facts: turn_outcomes: Map<(AgentIdentity, Generation, InputId), RecordedTurnOutcome { terminal_seq, outcome }> with RecordTurnOutcome and exact AcknowledgeTurnOutcome inputs. Redelivery never creates a second row; acknowledgement removes only an existing exact row and an absent acknowledgement retains no tombstone. Acknowledged rows are pruned immediately, with remaining generation-scoped retention also pruned at ReleaseMember/generation retirement; admission class TurnDirectiveUnsupported added to the §6.3 vocabulary. Persisted in the same host-realm SQLite table family.
• No Schedule/Occurrence machine changes; no ApprovalLifecycle changes; no new ControlScope verbs (explicitly: Approve is NOT added in v1).

​

18.10 Wire deltas (folds into §7; V4; regen-schemas + parity gates per §10 preamble)

• BridgeDeliveryPayload + turn: Option<BridgeTurnDirective { correlation: BridgeTurnCorrelation { run_id, step_id }, tool_overlay: Option<WireTurnToolOverlay> }> (absent-omitted; fail-closed on old receivers via existing deny_unknown_fields).
• BridgeDeliveryRejectionCause + TurnDirectiveUnsupported { detail }.
• PollMemberEvents exact outcome_acks + independent max_outcomes; BridgeReply::MemberEventsPage bounded turn_outcomes: Vec<BridgeTurnOutcomeRecord { input_id, generation, terminal_seq, outcome: WireFlowTurnOutcome }> + outcomes_complete sidecar metadata (EventEnvelope and event page rows unchanged — restating the §7 envelope freeze).
• MaterializeMember.spec.tool_access_policy: Option<WireResolvedToolAccessPolicy { AllowList | DenyList }> — Inherit unrepresentable; MaterializeMember.spec.overlay.budget_limits: Option<BudgetLimits> is the sole digest-covered budget carrier.
• Cross-host spawn request carries requested_tool_access_policy_present: bool separately from resolved_tool_access_policy (O3 no-laundering rule).
• BridgeCapabilities/HostCapabilityFlags + approval_forwarding: bool.
• Removals: WireBudgetSplitPolicy (wire/mob.rs:713, emit.rs:1392), RPC budget_split_policy param (handlers/mob.rs:436-438) — clean break, no tombstones.

​

18.11 Phase and test additions (folds into §10/§11)

• Phase 1: all §18.9 catalog deltas + §18.10 contracts deltas + the §7.3 budget-sentence correction; TLC bounds unchanged (2 hosts × 3 members) now covering flow-dispatch classification and the workgraph-placement denial.
• Phase 2: rkat mob host spawns the schedule host (realm-local stores, Noop mob host, no runnable registry).
• Phase 3: sealed policy + budget seed in materialize (member host persists received policy and applies budget seed via the with_spawn_budget_limits shape); presence-fact/resolved-policy split on member-host-originated spawns; workgraph placement gate live; BudgetSplitPolicy code removal (launch.rs, spec/builder, tools, RPC); taint relay branch extended to HostMaterialized.
• Phase 5: no deltas from this dimension (recorded: no Approve scope).
• Phase 6: remote flow dispatch end-to-end — directive send, member-side tracked-turn admission + shared terminal classifier + durable journal, pump sidecar consumption, remote flow ticket, ClassifyFlowStepDispatch wiring, deletion of the shell-side autonomous-overlay reject (actor_turn_executor.rs:275-279) in favor of the machine classification; supersede the pinned peer-only failure test (tests.rs:23945-24018) with the new typed shapes; BRIDGE_CLASSIFIER_FILES (xtask/src/bridge_classifier.rs:27-31) extended with every new BridgeReply consumer (journal/pump/flow-executor files). (v4.1.2 errata, ADJ-P6-13: the shell-side overlay reject was deleted in phase 6 as planned — the guards moved into the machine (mob_machine.rs ClassifyFlowStepDispatch), so the actor_turn_executor.rs:275-279 anchor is superseded.)
• Phase 7: console approval_forwarding labeling; docs.

• unit: WireResolvedToolAccessPolicy decode rejects inherit (serde, fail-closed); shared terminal classifier covers all seven terminal events + channel-close; journal dedup/generation-scoping; ClassifyFlowStepDispatch kernel matrix; workgraph-denial guard; TLC green at 2×3 with the new inputs.
• int / e2e-fast (two-hosts-in-one-process harness): flow run with a remote TurnDriven member completes via journal+sidecar, overlay enforced member-side (denied tool ⇒ access_denied inside the remote turn); remote AutonomousHost step without overlay completes; overlay+autonomous rejected at dispatch classification (local and remote, same cause); attribution correct under interleaved queued inputs (peer send racing a flow step); Deduplicated redelivery converges on one outcome; generation bump mid-step fails typed; pre-V4 directive decode-reject shape; restricted parent on Host B spawns onto Host A and Host B — both children contained, wire never carries Inherit; budget seed enforced member-side (max_tool_calls ⇒ typed budget stop); workgraph remote placement denied / local allowed / tools.workgraph=false remote allowed with task-workflow preload; scheduled member_send and run_flow to a remote member deliver via runtime verbs, scheduled-flow completion via flow_status; mob-target schedule on member host fails typed (Noop pin); host_runnable absent-registry TargetMissing pin; taint re-declaration after remote respawn (declare → rematerialize → verify lapse → re-declare → envelope carries claim); console labels approval_forwarding=false.
• e2e-system (real multi-process TCP): flow run across rkat mob host with member-host restart mid-step ⇒ typed step timeout, run ledger honest; member-host schedule driver fires a session-target schedule from the host’s realm store.
• e2e-smoke (live): the §11 kitchen-sink A/B/C run includes one cross-host flow with an overlay-bearing step.

​

18.12 Non-goals additions (folds into §12) and gotchas (folds into §13)

​

19. Member session lifecycle across hosts: launch modes, disposal, transcript edits, compaction, memory, claims

• MemberLaunchMode = Fresh | Resume { bridge_session_id } | Fork { source_member_id, fork_context }; ForkContext = FullHistory | LastMessages { count } (meerkat-mob/src/launch.rs:20-35,49-61). Fork is not Session::fork() copy-on-write: the source history is read via the controlling host’s local session service (SessionServiceHistoryExt::read_history, actor.rs:9179-9191), rendered to text (render_fork_context, actor.rs:911), and prepended to the child’s initial prompt as a plain ContentBlock::Text before provisioning (actor.rs:9240-9248). The child gets a fresh session.
• The fork source resolve is local-only: roster → MemberRef::bridge_session_id() (meerkat-mob/src/event.rs:114-119); a source without a session yields untyped MobError::Internal("fork source ... has no session") (actor.rs:9146-9150); LastMessages reads local view.state.message_count (actor.rs:9158-9176).
• Resume validation is entirely realm-local: is_member_active fast-path (actor.rs:8978-8987), AutonomousHost requires a local interaction-event injector (8988-8997), comms-runtime presence when wiring exists (8999-9012), inactive fallback = load_persisted_session + build_resumed_agent_config (9038-9074); the persistent-unsupported/missing-snapshot exits are untyped Internal today (9044-9048, 9128-9130).
• Local member retire archives durably and loudly: disposal pipeline StopHostLoop → NotifyPeers → ArchiveSession (meerkat-mob/src/runtime/disposal.rs:28-32), ArchiveSession failure is critical (actor.rs:14257-14275), realized as SessionBackend::retire_member → archive_with_authority_then_unregister → archive_with_mob_lifecycle_authority (provisioner.rs:2185-2195, 857-936) with a deliberate carve-out: adopted host-owned sessions (a Resume over a store the mob does not own) get runtime-retire + binding release only (provisioner.rs:868-897). dispose_archive_session tolerates NotFound as success (actor.rs:15697-15716).
• Remote (peer-only) retire today is runtime-retire only: controlling side sends BridgeCommand::RetireMember then mark_member_retired (provisioner.rs:3197-3248); the receiver executes adapter.retire_runtime(session_id) — no SessionDocumentMachine archive (meerkat-runtime/src/comms_drain.rs:2788-2825); DestroyMember likewise maps to RuntimeControlPlane::destroy (comms_drain.rs:2827-2864).
• And yet the machine records an archive either way: ObserveMemberRetirementArchived is signalled whenever the ArchiveSession step “completed” (actor.rs:15285-15289, 15725-15737) — which is true for the host-owned carve-out and for the remote runtime-only retire. The archived fact is a fiction in both cases.
• Archive truth is owned by the canonical SessionDocumentMachine: Archived is the absorbing terminal, re-archive is the explicit AlreadyArchived verdict (meerkat-machine-schema/src/catalog/dsl/session_document.rs:343-383), realized fail-closed durable-document-commit-FIRST / runtime-retire-SECOND by MachineSessionArchiveProtocol (meerkat-session/src/persistent.rs:1521-1600) and read back via session_archived_by_authority / reject_if_archived_session (persistent.rs:1608-1650). All per-session, realm-local.
• Transcript edits (session/fork_at, fork_replace, rewrite_transcript, transcript_revision, transcript_revisions, restore_transcript_revision) are RPC-only (meerkat-contracts/src/rpc_catalog.rs:135-160; REST deliberately dropped them — rest_catalog.rs:174-181), implemented only by PersistentSessionService (persistent.rs:5652-5655; the core trait defaults are typed Unsupported, meerkat-core/src/service/mod.rs:2016-2062), and admitted runtime-locally (staged-session check + resolve_transcript_edit_admission on the local MeerkatMachine, meerkat-rpc/src/session_runtime.rs:7563-7614).
• Compaction runs inside the agent loop of whichever host runs the session (CheckCompaction effect → run_compaction, meerkat-core/src/agent/state.rs:1233-1265); DefaultCompactor + optional curator are wired at AgentFactory build time (meerkat/src/factory.rs:5700-5716); CompactionCurator is an in-process trait with no wire form (meerkat-core/src/compact.rs:175-192). Compaction discards index into MemoryIndexScope::for_session in the same host’s realm (agent/state.rs:1365-1373).
• MemoryStore::drop_scope / enumerate_scoped have zero production callers at HEAD: workspace grep hits only meerkat-core/src/memory.rs, meerkat-memory/src/simple.rs, meerkat-memory/src/hnsw.rs. NOT FOUND: any caller in mob/session/runtime/cli/rpc/rest/facade/mcp-server/mob-mcp. Nobody cleans member memory on retire — locally or remotely. Pre-existing, symmetric.
• Session-identity claims are process-scoped by design: SessionClaimHandle + DefaultSessionClaimRegistry::global() (meerkat-core/src/handles.rs:2096-2148), one registry per MeerkatMachine (meerkat-runtime/src/meerkat_machine/mod.rs:2365-2373; re-export meerkat-runtime/src/handles/session_claim.rs:1-17), acquired at comms-runtime construction and held RAII (meerkat-comms/src/runtime/comms_runtime.rs:1573,1890-1893).
• Whole-mob resume is controlling-realm-local: reconcile_resume census over the local session service (builder.rs:2638-2652), orphan archive (2662-2675), recreate-from-snapshot for members with member_session_bindings entries (the skip at 2680-2687 applies only to members without a binding). Ops-owner anchoring for members without a local session goes through owner_bridge_session_id with a silent skip when it is None (actor.rs:8541-8562, skip at 8553-8554) and a fail-closed divergence check (8582-8600).
• Owner-archive cascade runs controlling-host-local: destroy_bridge_session_mobs + orphan scavenging (meerkat-mob-mcp/src/lib.rs:1784-1816, 1826-1863), remote teardown bounded by remote_destroy_cleanup_deadline (actor.rs:15816-15823).

​

19.L1 — MaterializeMember.launch_mode carries Fresh | Resume only; Fork is unrepresentable on the wire; Resume executes on the member host.

Current amendment: the shipping private wire is Fresh {} or Resume { session_id, resume_from_role? }. The optional predecessor role is one-request authority for an exact cold durable role migration. Omission remains strict same-role resume. Fork is still structurally absent. The following section records the original v4.1 launch design before that additive trusted-host field.

​

19.L2 — Cross-host fork: remote TARGET works at phase 3 by construction; remote SOURCE is a proxied ReadMemberHistory read landing with phase 6; the untyped no-session error is retyped now.

• Remote target (fork from a local source onto a remote host): works as soon as phase 3 lands — the rendered fork text is already inside the materialize spec’s initial prompt. Nothing to build.
• Remote source: the fork context read routes through the same placement switch as mob/member_history (§7.4) — local member ⇒ local read_history; remote member ⇒ ReadMemberHistory pages, accumulated controlling-side against the first page’s pinned message_count, then rendered by the same render_fork_context. LastMessages is tail-addressed in its first request; normally that one byte-bounded page is complete, while large rows may require monotonic next_index continuation. A single row that cannot fit the transport-safe reply budget fails typed rather than timing out or silently dropping fork context. Ships with phase 6.
• Typed reject, both eras: MobError::ForkSourceUnavailable { source_member_id, cause: NoSession | RemoteReadUnavailable } replaces the untyped MobError::Internal("fork source ... has no session") (actor.rs:9146-9150). NoSession covers peer-only external sources (unchanged semantics, now typed); RemoteReadUnavailable covers a remote source before phase 6 lands or when the owning host is unreachable (Unavailable bridge outcome). The retype lands in phase 3 so the phase-3→6 window never ships the untyped shape.

​

19.L3 — ReleaseMember performs full mob-owned durable disposal on the owning host; disposal class is a typed reply fact. (Amends §7 host-addressed commands and §7.3.)

1. MobHostBindingAuthority admission: (agent_identity, generation, fence_token) validated; replay at the recorded tuple returns the recorded disposal (dedup memory extended to remember release outcomes, mirroring materialize dedup, §6.3); a lower tuple is typed StaleFence.
2. Two-layer disposal order, mirroring the local realization EXACTLY (an implementer following a flat ‘archive-first’ rule would archive a still-running session and race): OUTER quiesce first — cancel any active turn → control-plane runtime retire → drain — the retire_runtime_before_archive shape (provisioner.rs:866 → :627-686); THEN the archive protocol, whose commit-first ordering is protocol-INTERNAL (MachineSessionArchiveProtocol, persistent.rs:1521-1600: the SessionDocumentMachine ArchiveSessionDocument durable commit lands in the member host’s realm before the machine-owned document Retire terminal). A failure in either layer fails the release with a typed cause.
3. Idempotency mirrors local tolerance: NotFound and AlreadyArchived (session_document.rs:369-383) resolve to success-class outcomes (actor.rs:15708-15716 precedent).
4. Claims/memory: the member’s comms-runtime teardown releases its session-identity claim via RAII (comms_runtime.rs:1573) — no bridge involvement; no memory cleanup (L6).

​

19.L4 — ObserveMemberRetirementArchived AND its destroy sibling stop lying: both signals gain the typed disposal field, total over local and remote. (Amends §6.1 machine deltas.)

​

19.L5 — Whole-mob resume and ops-owner anchoring are placement-gated. (Amends §7.3 recovery and §6.1 invariants.)

• reconcile_resume’s census and orphan-archive only ever see the controlling realm (builder.rs:2638-2675) — correct for local members, and remote session ids in member_session_bindings are harmless there (the archive set is active_local − machine). But the missing-session recreate loop is a live trap: HostMaterialized members DO have member_session_bindings entries (from the materialize ack, §6.1), are never in the local active_ids, and would enter local snapshot restore (builder.rs:2680-2687 only skips members without a binding) — producing a bogus local recreate of a remote member. The loop gains a placement gate: member_placement present ⇒ skip local recreate entirely; remote members reconcile via the (re)bind HostStatus sweep + ReleaseMember-at-stale-fence (§7.3) and, where the host reports the session live, plain rebinding — Resume of a host-materialized member is the rebind/recovery path, not a new mechanism.
• Ops-owner anchoring extends the owner-bridge-session invariant (commit 093af8cf1; actor.rs:8541-8562, fail-closed check 8565-8633): HostMaterialized members bind their controlling-side ops owner to the MobMachine-owned owner_bridge_session_id exactly like peer-only members. The silent skip when owner_bridge_session_id is None (actor.rs:8553-8554) does not extend to them: §6.1 gains the invariant member_placement ≠ ∅ ⇒ owner_bridge_session_id ≠ None, enforced at ResolveSpawnMemberAdmission (typed placement reject when a remote spawn is requested on a mob created without owner-bridge authority), so the restore path can fail closed instead of skipping.

​

19.L6 — Host-local by construction: compaction, memory, claims. (Statements + §12/§13 amendments; zero new machinery.)

• Compaction is member-host-local because it is loop-internal (agent/state.rs:1233-1265): the member host’s provider credentials fund DefaultCompactor’s summarization call (wired at its AgentFactory build, factory.rs:5700-5716). CompactionCurator is an in-process trait with no wire form (compact.rs:175-192) — a curator configured on the controlling host cannot apply to remote members. v1 decision: curated compaction for remote members is configured on the member host process (rkat mob host composition), or not at all; DefaultCompactor is always the member-host default. There is no silent difference to type: curator presence is a host build choice, never a mob fact, and compaction failure semantics (CompactionFailed event, history preserved) are identical on every host.
• Memory: compaction discards index under MemoryIndexScope::for_session in the owning host’s realm (agent/state.rs:1365-1373). Cleanup is a pre-existing repo-wide gap — drop_scope/enumerate_scoped have zero production callers (NOT FOUND outside meerkat-core/src/memory.rs and meerkat-memory impls/tests) — and multi-host does not widen it, only multiplies where orphaned scopes live. v1 records the binding constraint so the future fix cannot be built wrong: memory cleanup executes on the owning host inside its release/archive path (the L3 realization is the insertion point), never as a bridge-served remote store handle (§3).
• Claims: SessionClaimHandle stays process-scoped — one registry per MeerkatMachine (mod.rs:2365-2373), process-global default for bare factory callers (handles.rs:2125-2148). The member host’s own machine registry claims each materialized session at comms construction and releases via RAII on teardown (comms_runtime.rs:1573, 1890-1893) — including on ReleaseMember. Cross-host duplicate-materialization protection is MobHostBindingAuthority’s (identity, generation, fence) dedup + fence monotonicity (§6.3), which is the distributed analog of the in-process claim. New gotcha (§13): the host acceptor registry and MobHostBindingAuthority must not grow into a distributed claim registry — “this session id is active” remains a per-process fact.

​

19.L7 — Transcript edits on remote member sessions are a typed v1 non-goal. (Amends §12.)

• v1: the family is owning-host-local. Raw session-id RPC verbs keep realm-local NotFound — truthful under §3, the id names no session in this realm. The by-identity console surface never dangles the verbs: mob/member_status already gains placement (§7 projections); it additionally carries the host’s durable_sessions-derived lifecycle capability flags so consoles label transcript editing (and revision browsing) unavailable for remote members instead of attempting and mis-reading NotFound. Precedent for a deliberately absent surface: the REST catalog’s recorded drop of this same family (rest_catalog.rs:174-181).
• v2 seed: RewriteMemberTranscript / ListMemberTranscriptRevisions / RestoreMemberTranscriptRevision bridge commands gated on a new ControlScope::RewriteTranscript, member-side admission reusing the existing machinery — only after phase 5, per the §8 ordering rule.

​

19.F Failure semantics (rows to add to the §9 table)

​

19.P Work items by phase

• Phase 1 (catalog + contracts): MaterializeLaunchMode wire enum + launch_outcome on MemberMaterialized; MemberReleased { disposal } reply + MemberSessionDisposal vocabulary; rejection causes ResumeSessionNotFound, CapabilityMissing, LaunchModeUnsupported, LaunchModePlacementMismatch; disposal field on the ObserveMemberRetirementArchived DSL signal + transitions; HostCapabilityFlags.durable_sessions; §6.1 invariant member_placement ≠ ∅ ⇒ owner_bridge_session_id ≠ None; MobHostBindingAuthority release-dedup memory; mob/member_status lifecycle capability flags; MemberHistoryPage.message_count pinned in the page mirror.
• Phase 3 (placement + materialization): member-side Resume realization + typed ack causes; ForkSourceUnavailable retype (replaces actor.rs:9146-9150 Internal); remote-target fork (falls out of spec-carried prompt text — covered by tests, no new code); ReleaseMember full disposal realization (archive-first order, idempotency, ephemeral degradation) + controlling-side truthful disposal classification for local AND remote retire; reconcile_resume placement gate on the recreate loop; ops-owner anchoring fail-closed for HostMaterialized; member-host claim acquisition/release through its machine registry.
• Phase 6 (events/history): remote-source fork context via ReadMemberHistory pages (shared placement switch with mob/member_history); LastMessages offset math over the mirrored message_count.
• Phase 7 (surfaces): console labeling of per-member lifecycle capabilities (transcript edits, revisions, resume-after-restart) from mob/member_status; rkat mob status output includes disposal class and placement.

​

19.N Non-goals (rows to add to §12)

• Remote transcript-edit family (rewrite/revisions/restore/fork_at/fork_replace over the bridge) — typed degradation: realm-local NotFound + mob/member_status capability labeling; v2 seed: bridge command family behind ControlScope::RewriteTranscript.
• Cross-host CompactionCurator propagation — curators are member-host process composition; DefaultCompactor is the universal default; no wire form exists or is added.
• Memory-scope cleanup on retire — pre-existing zero-caller gap, symmetric local/remote; constraint recorded: future cleanup is owning-host-only inside the L3 release path.
• Distributed session-claim registry — claims stay process-scoped; the cross-host analog is MobHostBindingAuthority fencing/dedup.
• Cross-host Session::fork() copy-on-write — does not exist even locally (fork is a rendered-context spawn); nothing degrades because nothing is removed.

​

19.G Gotchas (rows to add to §13)

11. ObserveMemberRetirementArchived fires today on ArchiveSession step completion even when the realization was runtime-retire-only (host-owned carve-out, provisioner.rs:868-897) — when adding the disposal field, classify from the typed provisioner/bridge outcome, never from step completion.
12. reconcile_resume’s recreate loop keys on member_session_bindings presence (builder.rs:2680-2687) — HostMaterialized members HAVE bindings; forgetting the placement gate silently recreates remote members locally.
13. The ops-owner None-skip (actor.rs:8553-8554) is load-bearing for legacy peer-only mobs; do not delete it — fence it off for HostMaterialized via the admission invariant instead.
14. MemberHistoryPage must mirror SessionHistoryPage.message_count (service/mod.rs:1497-1505) or remote LastMessages fork needs a second round-trip that nobody will remember to add.

​

20. Threat model and security posture

​

20.1 The containment invariant

• Peer impersonation — YES, bounded to placed members. The host holds every placed member’s private key (§7.3 key custody: minted and stays on the host), so it can sign envelopes as those members to every peer that trusts them. It holds NO other keys: not the supervisor’s (the bridge authority keypair lives in the controlling host’s SupervisorAuthorityRecord), not other hosts’ members’, not the mob owner’s. Its reach is exactly the wiring graph its members legitimately have.
• Observation fabrication — YES, labeled. The host is the only source of its members’ history/events (D2 bridge-served projections carry no cryptographic provenance in v1). It can fabricate console-visible transcripts for its own members. Mitigation, not prevention: every remote-served projection is typed HostClaimed (vs ControllingHostVerified, §7 projections), so consoles and MobKit can render the trust distinction; signed event provenance is a v2 seed.
• Ack lying — bounded by machine guards. A lying MemberMaterialized cannot commit arbitrary state: CommitSpawnMembership guards the digest echo against the machine-authorized value (A12), the fence tuple against machine facts, and membership/roster/wiring mutations only ever happen on the controlling machine. A host can lie about launch_outcome or health — observation-grade facts, HostClaimed by construction.
• Upcall abuse — bounded by generated agent authority and incarnation fencing. MemberOperatorRequest first requires the envelope signer, requester generation, and requester fence to match the MobMachine’s current member binding; it then re-mints only the controlling-host-recorded MobToolAuthorityContext facts for that identity+generation. A compromised host can invoke exactly the operator capabilities that member has as an agent, and no principal ControlScope grant is minted or consulted. It cannot mint grants, bind hosts, touch fences, replay an old incarnation through a reused peer key, or expand its capability set through wire claims (there are none).
• Authority — NO. Fences, generations, topology_epoch, roster, placement, grants, and rotation state advance only through the controlling MobMachine. A member host presents observations and requests; it decides nothing mob-semantic. MobHostBindingAuthority is host-LOCAL state about its own bindings, not mob authority.
• Credentials — NO. No credential, token, lease, or provider secret ever arrives on the wire (A2/A5/A10, type-level). A compromised host exposes ITS OWN realm’s credentials — the ones its operator provisioned — which is the pre-existing local-machine trust boundary, not a new one.

​

20.2 Undefended in v1 (stated, not laundered)

• Member-side fence validation on delivery does not exist (§6.4/A22): a stale supervisor is rejected by epoch, but delivery commands carry no member-fence check. Exposure: a controlling host racing its own respawns, not a third party (delivery is supervisor-signed).
• Host-local realm writes: an operator (or attacker) with filesystem/process access on a member host can mutate placed members’ sessions outside the fence path (§17.8). This is inside the host trust boundary — hosts are TRUSTED EXECUTORS for their placed members, admitted by explicit operator ceremony.
• Transport confidentiality: the comms link is Ed25519-signed plaintext (no cipher exists in meerkat-comms — verified NOT FOUND). On-path readers see envelope contents: peer messages, bridge payloads, event pages, and live WS tokens (A5; single-use, 60s TTL, channel-pinned). New host binding does not add another bearer: BindHost.bootstrap_proof is tuple-bound HMAC output. The older member-binding protocol still exposes its raw BindMember.bootstrap_token; that pre-existing residual is intentionally not expanded into the new host wire and requires a separately versioned remediation. Operational posture for hostile networks: tunnel inter-host links (WireGuard/TLS); v2 seed: encrypted comms transport, which closes this whole row.
• Acceptor pre-auth surface: the TCP acceptor peeks/classifies before signature verification (pairing branch). §21.2 bounds it operationally; it is not authenticated-only ingress.

​

20.3 Ceremony material custody

• Host binding descriptor (contains the one-time bootstrap token): written 0600 by rkat mob host, transferred out-of-band by the operator, used locally to derive a tuple-bound HMAC, and consumed single-use when that proof admits BindHost; the raw bearer never enters the remote command and is invalid thereafter (the canonicalize_bridge_address strip precedent applies — tokens never persist in advertised addresses). A leaked descriptor after bind is inert; a leaked descriptor before bind can let an attacker claim the host — revocable via RevokeHost, visible in mob/hosts.
• Host identity dir: 0700 dir / 0600 key, same discipline as member identity dirs (Keypair::load_or_generate).
• Host revocation and key rotation (v1): RevokeHost is the compromise-recovery verb — clears the bind, live endpoint, and capability record; placed members enter the revival ladder (§9 row). Key rotation = revoke + fresh ceremony with a new descriptor. Online host-key rotation is a v2 seed.
• Grants: issued only through AdminGrants-scoped surfaces (owner-implicit in v1, A16); persisted in the controlling host’s mob store; never on member hosts.

​

21. Operations, packaging, and governance

​

21.1 Rolling upgrades and protocol skew

• Spawn/placement admission onto a bound host whose supported_protocol_versions excludes V4 is a typed reject (protocol range is an admission-gating flag, §6.1).
• Rebind re-records capabilities (HostRebound); a range/capability regression routes affected members through revival classification with a typed cause (§9 row) — never silent degradation.
• Mid-flight upgrade: an ack engine_version differing from the bound record is typed HostEngineVersionChanged → rebind → retry (§15 R8).
• Procedure for a live mob: upgrade the controlling host (members keep running — the bridge tolerates supervisor restarts via durable authority records); then per member host: drain new placements (operator choice), upgrade, restart → rebind → capability re-record → host-autonomous member revival (A20); respawn members only where engine_version sensitivity matters (operator policy — equal specs on unequal binaries are honestly different builds, §15 R8).

​

21.2 Ingress hardening and resource governance

• Acceptor pre-auth bounds (the peek/classify + pairing parse run before signature verification): connection cap + per-connection read deadline + the existing MAX_PAYLOAD_SIZE frame bound + a pairing-attempt rate limit per source. These are host-role config (§21.3), mechanical shell limits — no machine facts.
• Poll-pump fan-out (v1): one pump per remote member per mob on the controlling host, under a fixed per-mob ceiling of eight concurrent polls. Six permits serve observation-only 10s long-polls; two permits are reserved for machine-owned remote-turn / placed-kickoff / completion-cleanup custody, whose polls use a 250ms window. Before contending for its global class permits, every pump crosses a one-per-host weak semaphore for that class, so hundreds of blackholed members on host A can occupy or queue at most one global observation slot and one global custody slot while a healthy host B remains independently eligible. A queued pump reclassifies when its liveness facts change, releasing the old host-class gate before it competes in the new lane; the combined in-flight ceiling remains eight. Per-host batched polling and a configurable cap require a new observation transport/config seam and remain v2 work alongside outbound connection reuse (§12); v1 does not claim either one.
• Placed cleanup fan-out (v1): placed kickoff and ordinary-completion reconcilers admit at most one due row per host into a rotating eight-host window. Per-host row cursors prevent a blackholed low row from starving sibling custody, and the host cursor advances beyond the last admitted host so large fleets do not repeatedly overlap the same window. Mob Stop is two-phase: first persist KickoffCancelRequested and join every volatile kickoff producer, then—only after exact kickoff custody drains—run a bounded rotating window of exact fenced interrupts off the actor loop. No controller-wide mutex spans bridge I/O; same-key host cancellation tombstones arbitrate cancellation racing a delayed kickoff delivery. Retire/Complete/Destroy instead proceed to authenticated host release/revoke and dispose exact kickoff custody, so a blackholed ordinary cancel cannot deadlock teardown.
• Ephemeral live buffer (durable_sessions=false hosts): bounded ring, size in host config; overrun is the typed StaleCursor path — sizing changes the window, never the semantics.
• One periodic host poll, two consumers: the reachability probe (§7.5) and orphan reconciliation share the SAME HostStatus poll loop — reconciliation is therefore continuous, not rebind-only (a healthy host that never restarts still gets its orphans released at stale fences). Mass-rebind after a controlling restart staggers polls with jitter.

​

21.3 Host daemon configuration (the layered-config row for the new role)

[mob_host]
realm            = "…"        # else workspace-derived (R2); Isolated is a typed startup reject
listen_tcp       = "0.0.0.0:7801"
advertise_tcp    = "tcp://host-b.example:7801" # REQUIRED for non-loopback (advertised, never derived)
live_ws          = "0.0.0.0:7802"             # optional; presence = live-capable
live_ws_advertise= "wss://host-b.example"      # REQUIRED with live_ws (§16 DL6); fixed live path is appended
identity_dir     = "<state_root>/host-identity" # 0700; key 0600
descriptor_out   = "./host-binding.json"      # 0600 — contains the bootstrap token (§20.3)
max_connections / read_deadline_ms / pairing_rate / live_buffer_events   # §21.2 bounds

​

21.4 Crate placement and release blast radius

​

21.5 Docs and governance-gate inventory

​

21.6 MobKit consequence pass (expands phase 8)

• Ordering: Meerkat release with phases 1-7 → MobKit bumps its pin → MobKit consumes. No MobKit change ships against an unreleased wire shape.
• Unaffected by default: MobKit talks local RPC to the controlling host = owner principal (A16) — default-deny grants change nothing for it. Its per-turn injection lane (injected_context) already bridges to remote members via DeliverMemberInput (shipped, §15.1). Its resume-strand logic operates on controlling-host session projections — placement-blind by construction.
• New consumption: placement + reachability + lifecycle-capability fields on member_status; mob/member_history; mob/hosts; grants surfaces (as an AdminGrants-scoped operator UI, later); HostClaimed provenance labeling in console rendering (§20.1 — MobKit must not render host-claimed transcripts as verified).
• Fleet view across mobs is a MobKit projection concern (hosts are per-mob MobMachine facts; there is no cross-mob host registry endpoint, §17.10).

​

21.7 RPC/REST principal identity (the recorded v2 seed)