From fd7f7557bd181022893cae3edd9f6e432272ebac Mon Sep 17 00:00:00 2001 From: jochen Date: Sat, 29 Aug 2026 14:01:00 +0200 Subject: [PATCH] The node's own session, and why it is not hired Answering a question that was asked three times and that I kept not answering: should the node's session just be an agent per node, since otherwise the functionality exists at two levels? Same mechanism, different lifecycle. A persistent session, accumulating memory, a system prompt, a scoped tool list, addressable by message -- identical, and building that twice is the duplication the question was worried about. What must not be shared is the lifecycle, because if a node's own voice were an ordinary hired agent it could be retired, leaving a node nothing can talk to; reassigned, moving one machine's mind onto another; hired twice, with no answer to which one replies; or never hired, leaving a node mute. The exemption in this record exists to make those four unreachable. I had this backwards earlier today and said so out loud: I called "a node itself is an agent of a kind exempt from the hiring lifecycle" a fossil of the old model and recommended striking it. It is the design. And it does not conflict with 0001 -- "the two agent rows per node merge" means one per node, not zero. I read merge as delete and invented a contradiction between two records that agree. Engrams are recorded for the first time. They are in use on every node and appear in no record, which is how a decided thing comes to look accidental. The engram is the node's system prompt, and it is what makes one node's answers recognisably its own rather than generic. Also recorded: there is no authorisation between nodes, because every node is the operator's own and a prompt from one is a prompt from them. The consequence is stated once rather than left to be discovered -- the mesh boundary is the security boundary, which is what puts the whole perimeter on the token and the overlay. And how a node passes a question on is the node's choice, not a protocol field. A node may say who is asking or may simply ask, the way a person relaying a question decides how to phrase it. That follows from the engram. The cost is that there is no machine-readable chain of who ultimately asked; each node still holds what it was asked and by whom. --- .../0003-agents-are-persistent-employees.md | 56 +++++++++++++++++++ 1 file changed, 56 insertions(+) diff --git a/02-DECISIONS/0003-agents-are-persistent-employees.md b/02-DECISIONS/0003-agents-are-persistent-employees.md index 5bbe516..3f9945c 100644 --- a/02-DECISIONS/0003-agents-are-persistent-employees.md +++ b/02-DECISIONS/0003-agents-are-persistent-employees.md @@ -51,6 +51,62 @@ when it expires. A temporary employee is still an employee. Some agents are **human**. What differs is modality — how the agent acts — not category. A node itself is an agent of a kind exempt from the hiring lifecycle. +### The node's own session + +*Written 2026-08-29. The sentence above is the whole of this and had been left as one line, which +is why it kept being read as a leftover rather than as the design.* + +**Every node holds one session of its own, permanently.** It listens on its own queue, anything in +the mesh may prompt it, and it remembers — what it was asked ten minutes ago and what it was asked +last week, across every caller, the way any conversation is remembered by both sides. Its system +prompt is the node's **engram**: the personality that makes one node's answers recognisably its +own. + +Nothing about it is request-response. A caller asks, the node answers, the exchange stays. + +**It is the same mechanism as a hired agent, and deliberately not the same lifecycle.** That +distinction is the answer to a question asked repeatedly and worth settling here: + +| the same | different | +|---|---| +| a persistent session, accumulating memory, a system prompt, a scoped tool list, addressable by message | how it comes into existence, and whether it can stop | + +**One implementation, two ways of existing: hired, or inherent to a node.** Building the mechanism +twice is real duplication and the concern was right; collapsing the lifecycles is the other mistake +and it is worse. + +**The exemption is not bureaucracy — it removes four states that make no sense.** If a node's own +voice were an ordinary hired agent it could be **retired**, leaving a node nothing can talk to; +**reassigned**, moving one machine's mind onto another; hired **twice**, with no answer to which +replies when the node is addressed; or hired **not at all**, leaving a node with no voice. The +exemption is what makes those unreachable. + +[ADR 0001](0001-mesh-brokers-nodes-host-agents-think.md)'s *the two agent rows per node merge* is +the same fact from the other side: **one per node** — not zero, and not two. + +### What is scoped, and what is not + +**Its tool list is its own and narrower than a session a person drives.** The same scoping any +agent has; a different list. + +**There is no authorisation between nodes.** Every node is the operator's own, and a prompt from +one is a prompt from the operator. Asking a node something is asking a colleague, and colleagues do +not present credentials. + +Stated once so it is not discovered later: **the mesh boundary is therefore the security +boundary.** Anything inside can reach whatever any node can reach, which is what makes the token +and the overlay the entire perimeter ([ADR 0004](0004-a-node-and-how-it-joins.md), +[ADR 0007](0007-connectivity.md)). + +**How a node passes a question on is the node's own choice, not a field in a message.** Asked +something it must ask a third node about, a node may say who is asking or may simply ask — the way +a person relaying a question decides how to phrase it. That follows from the engram, not from a +protocol. What it costs is a machine-readable chain of who ultimately asked; what each node was +asked, and by whom, remains in that node's own record. + +**A node thinks about one thing at a time**, being one session. Callers queue, and a long answer +delays the others. + ## Consequences - Memory, workspace and reputation have a subject to belong to. Policy becomes possible: an