Design 58: milestones for the operator to confirm, owners named, and the as-is of logins on the bus (playbook 04)

Playbook 02 adds a graduated effort's words; design 58 now says agent harness, never the bare word.

00-META/glossary.md

@@ -101,8 +101,8 @@ are a published vocabulary, fixed by the manifest's schema. **Decided by** ADR 0
   (ADR 0188).
 - **tool** — one capability a module serves through the tool runner, addressed `<module>.<tool>`. A
   seat's **verb** is the same thing carried by a seat rather than a module.
-- **mesh-sdk** — the library a module's own code is written against, including the harness that serves a
-  tools bundle to the tool runner. The harness is part of it, not a library of its own.
+- **mesh-sdk** — the library a module's own code is written against, including the SDK harness that serves a
+  tools bundle to the tool runner. The SDK harness is part of it, not a library of its own.
   *Not:* ~~tools-sdk~~
 - **invokes** — the manifest word for the tools a module calls, `<module>.<tool>` each or `*` for every
   one. A grant on the publish side and nothing else; a module that declares none calls nothing.
@@ -270,8 +270,8 @@ and Health and repair. **Decided by** ADR 0100, 0126, 0176, 0181, 0207, 0221, 02
 **Purpose.** To issue, hold, rotate and check the credentials and grants by which modules, nodes, agents
 and the operator act. **Recorded by** the controller's `identity` and `licences` databases and the vault.
 **Upstream of** Provisioning, Change and delivery, and Operator and conversation.
-**Decided by** ADR 0085, 0113, 0183, 0225, 0234.
-**Uses:** module, node, operator, consumer (Provisioning).
+**Decided by** ADR 0085, 0113, 0183, 0225, 0234, 0386, 0387, 0388.
+**Uses:** module, node, seat, tool (Module), operator, consumer and provision (Provisioning), agent and ask (Operator and conversation).
 
 - **credential** — anything that proves an identity: a password, a key, a token. A **pair credential**
   is the two ends of one credential, the consumer's and the provider's.
@@ -283,8 +283,24 @@ and the operator act. **Recorded by** the controller's `identity` and `licences`
   (ADR 0283).
 - **vault** — the module that owns every secret (`mesh-vault`,
   [24 — The secrets vault](../03-DESIGN/01-to-be/24-the-secrets-vault.md)).
-- **grant** — what an identity may call or reach, bounded by the provisions it requires
-  (ADR 0225).
+- **identity** — a person, an agent or a module as the mesh knows it: a name, a kind, a role, and whether it
+  is switched on. Every identity and role is held by the identity seat, in the bus's key-value store, and
+  changes only through its verbs (ADR 0386).
+- **role** — what an identity may call, as a set of grants (ADR 0386). Not a seat: a bare *role* is a
+  homonym (see [Homonyms](#homonyms)).
+- **grant** — one line of a role: an effect everywhere, an effect on one seat, or one named tool, and may be
+  limited to named machines; a dangerous tool is granted only by name (ADR 0386). A module's role
+  is made from what its manifest declares it calls (ADR 0386 §4).
+- **effect** — a tool's mark, set by its module in its manifest: **reads**, **acts** or **dangerous**; a
+  tool served without one counts as dangerous (ADR 0387).
+- **break-glass agent** — the one agent that holds every tool and never asks: sealed until the operator, or
+  a condition the operator named, opens it, open until the operator closes it, and every act it takes told
+  at once (ADR 0387).
+- **signed login** — a bus login signed by a key the bus trusts, carrying its expiry, which the bus checks by
+  its signature instead of reading a list (ADR 0388). The identity seat signs with one **signing key** per
+  role.
+- **root key** — the key at the top of the signed logins, which vouches for the signing keys: sealed in the
+  vault and used only to replace them, on the operator's Approve (ADR 0388).
 - **bus account** and **membership** — a module's or a node's account on the bus, and the subjects it
   is issued. The bus server calls its accounts *users*; the mesh says bus account.
 - **rotate** — replacing a credential without a consumer holding one the provider does not know.
@@ -503,8 +519,8 @@ it should not. **Recorded by** the controller. **Upstream of** Provisioning and
 trust. **Recorded by** the router (asks, warrants and the operator's identities).
 **Downstream of** Health and repair, Change and delivery, and Identity and access. An authorising
 answer acts in whichever domain asked, through that domain's own verb; the conversation owns the
-asking, never the act. **Decided by** ADR 0152, 0175, 0234, 0259, 0272.
-**Uses:** operator, person, proof (Identity and access), release (Change and delivery).
+asking, never the act. **Decided by** ADR 0152, 0175, 0234, 0259, 0272, 0383, 0384, 0385, 0390.
+**Uses:** operator, person, node, module, seat, tool (Module), proof and identity (Identity and access), release (Change and delivery).
 
 - **mesh MCP server** — the endpoint on a node's loopback through which every agent and person on that
   node reaches the mesh: the MCP server named `mesh`, with its five tools `mesh_overview`,
@@ -559,8 +575,21 @@ asking, never the act. **Decided by** ADR 0152, 0175, 0234, 0259, 0272.
   instructions.
 - **reference** — an opaque token in a message's words standing for a detail the content rule keeps out
   of them (a path, an address); opened with `detail` only on a `private` channel or through the mesh MCP server.
-- **agent** — a coding agent: the operator's, or one the mesh runs. Not the node-engine, and not the
+- **agent** — a coding agent: the operator's, or one the mesh runs; to the mesh, an identity of kind agent
+  (ADR 0386). Not the node-engine, and not the
   build seat's holder, whose seat name `node-build-agent` is an identifier to rename.
+- **thread** — one line of agent work, owned by the mesh: its turns, tool calls and results, its workspace
+  and usage, kept whole for good on the bus by the thread seat; it outlives any session, node or front end
+  (ADR 0383, ADR 0384).
+- **session** — one run of an agent harness on a thread.
+- **agent harness** — the program that runs an agent's sessions, its context manager and loop: Claude Code
+  today (ADR 0384). Not the SDK harness (see [Homonyms](#homonyms)).
+- **thread handler** — the node seat whose holder runs threads' sessions headless, on the always-on nodes
+  (ADR 0384).
+- **workspace toolkit** — the tools a session works with on its thread's workspace, the same for every agent
+  harness: the node seat `workspace` (ADR 0385).
+- **sandbox** — the small virtual machine one session runs in, with its thread's workspace mounted
+  (ADR 0390).
 - **instruction section** — one named section of the managed instruction file, which every agent session on the
   nodes it is for reads first, as the mesh's word: set at the controller's terminal in the agent module's
   settings, or **proposed** by an agent and made active on each node only by the operator's warrant, which that node
@@ -624,7 +653,7 @@ Not a domain of the mesh but of the way it is built, listed because its words me
   `changed`, `superseded`): a later record may change one clause and leave the rest
   (ADR 0290). Not a *rule*, which is a line of
   `00-META/how-we-build.md`.
-- **knowledge base** — the role that holds the decision records and research efforts whole (number, status, topic,
+- **knowledge base** — what holds the decision records and research efforts whole (number, status, topic,
   typed links, clauses and reasoning, with every version), takes them as proposals, has them reviewed and accepted,
   and answers what holds: the seat `knowledge-base`, held by the module `mesh-knowledge`
   ([55 — The knowledge base](../03-DESIGN/01-to-be/55-the-knowledge-base.md)). Not **the record**, the literal reader
@@ -634,7 +663,7 @@ Not a domain of the mesh but of the way it is built, listed because its words me
   holds it whole: its report, diagnosis and resolution included (ADR 0291);
   the folders in `04-ISSUES/` are imported there and removed.
   An **incident** is a past event that taught a rule.
-- **issue tracker** — the role that holds the mesh's issues and hands out their numbers: the seat `issue-tracker`,
+- **issue tracker** — what holds the mesh's issues and hands out their numbers: the seat `issue-tracker`,
   held by the module `mesh-issues` ([53 — The issue tracker](../03-DESIGN/01-to-be/53-the-issue-tracker.md)).
   Not hits's *item*; bare *ticket* is a homonym (see [Homonyms](#homonyms)).
   *Not:* ~~ticketing system~~ (hq), ~~ticket system~~ (hq)
@@ -688,6 +717,11 @@ renaming one sense, the old sense moves to a *Not:* line and becomes mechanical.
 | tier | a level of the mesh | **layer** | Core |
 | | a step of a rollout | **tier** | Change and delivery |
 | | how much proof an ask needs | **assurance level** | Identity and access |
+| harness | the part of `mesh-sdk` that serves a tools bundle | **SDK harness** | Module |
+| | the program that runs an agent's sessions | **agent harness** | Operator and conversation |
+| | the TypeScript `provisioner` helper for database providers | **`provisioner`**, renamed by design 57 | Provisioning |
+| role | what a seat names, at a scope | **seat**; the bare word in older designs is tracked by issue 872 | Module |
+| | what an identity may call | **role** | Identity and access |
 | ask | a request for the operator's input | **ask** | Operator and conversation |
 | | an entry in the build queue | **build request** | Change and delivery |
 | store | the one database server | **store** | Core |

00-META/repos.md

@@ -34,7 +34,7 @@ one-for-one — `mesh-catalog`, `mesh-sdk` and `mesh-tools` exist where the tabl
 | `mesh-foundation` | 1 | the four pinned services, as declarations |
 | `mesh-controller` | 2 | **exists.** The controller and its contexts — one of seven built (ADR 0006) |
 | `mesh-surfaces` | 3 | tools, web, cli |
-| `mesh-sdk` | — | the stable spine modules build against — the tool-serving harness, the messaging/event framework, the contracts and core primitives. Holds nothing per-module and nothing volatile (ADR 0039). |
+| `mesh-sdk` | — | the stable spine modules build against — the tool-serving SDK harness, the messaging/event framework, the contracts and core primitives. Holds nothing per-module and nothing volatile (ADR 0039). |
 | `mesh-lab` | — | **exists.** The lab — scenario lifecycle, networking, placement. Ships to nobody; runs on a workstation. |
 
 Tier 4's shape is open, and deliberately so: see ADR 0019 and

03-DESIGN/00-as-is/16-logins-on-the-bus.md

@@ -0,0 +1,41 @@
+---
+layer: as-is
+status: implemented
+code: [mesh-controller, mesh-tools]
+updated: 2026-10-16
+decisions:
+  - "ADR 0106"
+---
+
+# Logins on the bus, as they run
+
+**The bus reads one static list of logins from its settings file, in one account, written by the controller from
+its own records. Every module has a login per assignment; a person's login may call only the tools it was given;
+the sessions on the operator's machines call through their machine's tool-runner login, which may call every tool.
+Nothing marks what a tool does.** Read from the controller's and the tool runner's code on main on 2026-10-15
+(research 053, question 8). Design 58 replaces it.
+
+## The list
+
+- **One list, one account.** The controller writes every login from its records into the bus's settings file;
+  the bus re-reads it without dropping connections (ADR 0106 §3).
+- **A module's login per assignment**, named by machine and module, may publish and subscribe only what its
+  manifest declares it emits, consumes, serves and calls.
+- **A person's login** may publish only to the tools it was given and listen only on its own inbox.
+- **The caller is in the address.** A call's address carries the caller's name, so the runtime takes the caller
+  from the address, never from the message. For a seat every machine holds, the address also names the machine.
+
+## What it cannot do
+
+- **No expiry.** A login lives until its record is deleted and the list rewritten on the bus's node.
+- **No per-agent login.** Agent sessions reach the bus through each machine's tool-runner login, which may call
+  every tool on the mesh; what one session did cannot be told from another's.
+- **No effect.** No tool or seat verb declares whether it reads, acts or is dangerous; some module documents say
+  it in prose, and nothing reads that.
+- **Asks and warrants exist** (ADR 0259): a module can have one act authorised by the operator, bound to that
+  act; nothing yet asks for a dangerous call by itself.
+
+## How it is checked
+
+By reading: the controller's code that renders the bus's settings and the tool runner's caller check, on main.
+When design 58's switch is done, this document is replaced by the as-is of signed logins.

03-DESIGN/00-as-is/README.md

@@ -24,6 +24,7 @@ Where the two disagree, the implementation wins and the disagreement is stated.
 | [`13-the-console.md`](13-the-console.md) | The mesh's tools on the machine a person sits at, served by a module the mesh assigned there |
 | [`14-a-modules-state.md`](14-a-modules-state.md) | A module's current state on the bus: what the controller creates, the runtime serves, and the first live use showed |
 | [`15-the-agent-and-its-licences.md`](15-the-agent-and-its-licences.md) | The operator's agent on every machine and the licence manager that keeps its licences |
+| [`16-logins-on-the-bus.md`](16-logins-on-the-bus.md) | The bus's one list of logins, a login per module assignment, persons limited to their tools, sessions calling through the tool runner's login, and no effect on any tool |
 
 ## What these documents are not
 

03-DESIGN/01-to-be/58-agent-work-as-the-meshs-own.md

@@ -0,0 +1,181 @@
+---
+layer: to-be
+status: designed
+code: [mesh-catalog, mesh-media-catalog, mesh-sdk, mesh-tools, mesh-controller, mesh-host, mesh-lab]
+updated: 2026-10-16
+decisions:
+  - "ADR 0383"
+  - "ADR 0384"
+  - "ADR 0385"
+  - "ADR 0386"
+  - "ADR 0387"
+  - "ADR 0388"
+  - "ADR 0389"
+  - "ADR 0390"
+---
+
+# 58 — Agent work as the mesh's own
+
+**An agent's work belongs to the mesh, not to one vendor's program or one machine. A thread is kept whole on the
+bus by a thread seat; a thread handler on an always-on node runs the agent harness headless for it, in a sandbox
+of its own, with the thread's own branch on the forge as its workspace; the agent works through a workspace toolkit
+and named tools, never a general command runner. Every person, agent and module is an identity held by one identity
+seat, with a role made of grants; the bus checks each login by its signature, and the tool runner checks each call
+against the role, tool by tool, by the effect every tool carries.**
+(ADR 0383 to ADR 0390, from research 053.)
+
+**Acceptance.** The operator starts a thread from the terminal client, an agent on an always-on node works it in a
+sandbox, asks a question the operator answers in place, and the thread moves to another node and carries on with
+nothing lost; the agent's calls outside its role are refused, saying which grant is missing.
+
+## 1. The parts
+
+```
+  any node                         always-on nodes                        the control-node
+  ─────────                        ───────────────                        ────────────────
+  front ends                       nox-thread-handler                     nox-threads (seat thread)
+   ├ terminal client (first)        ├ takes a thread's lease               ├ a restricted stream per thread
+   ├ web page (then)                ├ runs the agent harness headless      ├ the object store for large content
+   └ Telegram: questions,           │   inside a microsandbox              └ leases in the bus's key-value store
+     approvals                      ├ answers permission requests
+        │                           │   through the mesh's asks           identity seat
+        │                           └ commits + pushes the workspace       ├ persons, agents, modules, roles
+        │                             branch every turn                    │   in the bus's key-value store
+        │                          nox-workspace (node seat workspace)    ├ signs logins (one key per role)
+        │                           └ read, glob, search, edit, write,     └ revokes over the bus, reads back
+        │                             git, named tools; no command runner
+        │                          claude-code
+        │                           ├ mirrors a session into its thread
+        │                           ├ rebuilds a session on pick-up
+        │                           └ writes the login and licence token
+        │                             into the sandbox
+        └──────────────── every call over the bus, carrying its thread and,
+                          for a module acting for an agent, the agent's token
+```
+
+## 2. Threads (ADR 0383)
+
+A **thread** is one piece of agent work, kept as a stream on the bus in the mesh's own format. The stream is the
+source of truth: the conversation, the agent's questions and their answers, tool calls and results, usage, and
+every change of state. Large content goes to the object store and is named from the stream. The stream is
+restricted (ADR 0376): only modules granted it read it. A thread is never deleted; the trail is kept for good.
+
+A thread is **open**, **assigned** (to a node and an agent harness), **released** or **stopped**. Its seat's verbs create,
+assign, release, stop, move it, and take it over with a reason. The assignment is a **lease** in the bus's
+key-value store, changed only by a compare-and-set on its revision. Its holder renews it every 20 s. A lease not
+renewed for 60 s is said to the operator; nothing takes it over by itself.
+
+## 3. Running a thread (ADR 0384)
+
+The thread handler on an always-on node takes the lease and starts the agent harness (Claude Code today) headless, one
+turn at a time. It answers the agent harness's permission requests through the mesh's asks, so a front end answers them in
+place. At the end of every turn it commits and pushes the workspace, which is the thread's own branch on the forge;
+a node that picks the thread up fetches it, so a move loses at most the turn in progress. Before a shutdown it
+releases at a turn boundary; on a stop it ends the process group, since a tool's child process outlives the agent harness.
+
+The claude-code module mirrors the session's stream into the thread and, on pick-up, rebuilds a session from the
+thread. Usage per thread comes from each run's result and rate-limit messages on the stream, not the transcript, and the
+licence manager records it with the thread as its session.
+
+The front ends are clients of a thread doing the same work: the terminal client first, then the web page, and
+Telegram for questions and approvals. Their first scope is the conversation as it streams, the agent's questions and
+permission requests answered in place, sending a message and stopping a turn. The rest is tracked by issue 850.
+
+## 4. The workspace toolkit (ADR 0385)
+
+The node seat `workspace`, held by `nox-workspace` on every thread-handler node and served through the mesh's MCP
+server, works in the thread's workspace only, by relative path: read, glob, regex search, edit, write, git, and named
+tools such as running the repository's tests and its merge check. It is built early. There is no general command
+runner in it, and no module offers one to an agent: a command an agent needs becomes a named tool in the module that
+owns it. Claude Code's own built-in tools, its command tool included, are turned off once the toolkit is in.
+
+## 5. Identities and roles (ADR 0386)
+
+The identity seat, held once for the mesh, owns every **identity** (a person, an agent or a module) and every
+**role**, in the bus's key-value store. An identity has a name, a kind, a role and whether it is switched on. They
+change only through the seat's verbs, each recorded with who asked; a module or front end whose role grants the
+seat's reads may watch the store live, and it holds no secret. Only the
+operator creates a person or an agent, or changes its role. A module's identity is asked for by the controller when
+the module is assigned to a node, named by machine and module, with a role made from what its manifest declares it
+calls.
+
+A role holds **grants**. A grant is an effect everywhere, an effect on one seat, or one named tool, and may be
+limited to named machines. Two fences check them: the bus, coarsely, by seat and module, from the role's signing
+key; and the tool runner, exactly, tool by tool, in the SDK. Every call carries its thread; a module acting for an
+agent carries a token the identity seat signed for that agent, and the tool runner then checks the agent's role. A
+refusal names the missing grant; every call is recorded with its identity and thread. A session on an operator's
+machine calls as the operator's person identity or as an agent, never through the machine's tool-runner login.
+
+## 6. Effects, asks and break-glass (ADR 0387)
+
+Every seat verb and module tool is one permission and carries one **effect**, set in its module's manifest:
+**reads**, **acts** or **dangerous**. The catalogue's check refuses an unmarked tool, once every module already in
+the catalogue is marked. A dangerous tool is granted only by name, and naming one in a role goes to the operator as
+an ask first. Every other dangerous act is an ask (ADR 0259), bound to that act and carried out on the warrant.
+
+The **break-glass** agent holds every tool and never asks. It is sealed until the operator opens it, or a condition
+the operator has named as opening it is raised (none is named at the start); it stays open until the operator closes
+it, and every act it takes is said to the operator at once. A tool served without an effect, from a module built
+before its mark, counts as dangerous.
+
+## 7. Signed logins on the bus (ADR 0388)
+
+The bus checks each login by its signature and reads no list. The root key is sealed in the vault and used only to
+replace the identity seat's signing keys, on the operator's Approve. The seat signs with one scoped signing key per
+role, so every login stays small and each identity gets its own inbox from the role's template. An agent's login
+lives minutes, a module's and a node's hours; each is renewed by a reconnect forced before expiry, by the handler or
+the node-engine.
+
+A switched-off identity is revoked over the bus. The seat reads back every update, sends updates at least a second
+apart, and resends the current state to every server id it has not seen on the system account, which every joined
+server carries. This changes ADR 0106's rule that the bus is configured only through its settings file.
+
+## 8. The switch (ADR 0389)
+
+A new bus with signed logins runs beside today's, joined as a leaf node carrying the system account. Identities move
+one at a time, each checked before the next. Streams, key-value buckets and the object store move last, each by a
+copy of its whole configuration: copy, wait for equal counts, stop its writers, then one update hands the addresses
+over. Today's bus is switched off when nothing is left on it.
+
+## 9. Sandboxes (ADR 0390)
+
+Each session runs in a microsandbox of its own, its version pinned and declared in a module. The workspace is
+mounted; the claude-code module writes in the agent's login and the licence token without its refresh part, and
+replaces the token as the licence manager refreshes it. Connections are allowed only to the vendor's interface, by
+address range, and to the bus. A node whose KVM modules are not loaded gets them from the sandbox module.
+
+## 10. The build's acceptance tests
+
+The build is not done until each of these has been shown, and the milestones of the work breakdown (playbook 04)
+carry them:
+
+1. A licence token replaced under a running session keeps that session working.
+2. The sandbox module loads KVM on the home server, and a sandbox runs there.
+3. Every existing module's tools carry an effect, and the catalogue's check refuses an unmarked one.
+4. The switch, run on the mesh's own modules in the lab from the bed test kept on the lab's branch
+   `research/053-signed-bus-logins`, loses nothing and leaves every identity on the new bus.
+5. The acceptance sentence at the top, end to end.
+
+## 11. Milestones
+
+Each milestone is one feature step (playbook 07), usable as soon as its delivery plan is done, and starts when
+the previous one's is. What it replaces is in the as-is documents
+[15 — The agent and its licences](../00-as-is/15-the-agent-and-its-licences.md) and
+[16 — Logins on the bus](../00-as-is/16-logins-on-the-bus.md). The issues are opened once the operator confirms
+the milestones, and their numbers written here.
+
+| # | Outcome, in one sentence | Proves | Repositories and their parts | Depends on |
+|---|---|---|---|---|
+| 1 | Every tool on the mesh says whether it reads, acts or is dangerous, a tool's description shows it, and the catalogue refuses a module that leaves one unmarked | test 3 | mesh-sdk: the effect in a tool's declaration, an unmarked tool served as dangerous; mesh-controller: the manifest field; mesh-catalog and mesh-media-catalog: every module marked, the check | — |
+| 2 | A session works on a repository's workspace through the mesh's tools alone: read, glob, search, edit, write, git, its tests and its merge check, with no command runner | — | mesh-catalog: the module `nox-workspace` on the node seat `workspace`, on the always-on nodes; mesh-controller: the seat | 1 |
+| 3 | A thread created through the thread seat runs headless on an always-on node, its conversation readable through the seat, its usage counted per thread, and a move to another node loses at most the turn in progress | — | mesh-catalog: `nox-threads` (seat `thread`, restricted streams, leases), `nox-thread-handler` (seat `thread-handler`), claude-code (mirror and rebuild), claude-licence-manager (usage per thread) | 2 |
+| 4 | The operator starts, follows, answers and stops a thread from a terminal client, and answers its questions on Telegram | — | mesh-catalog: the terminal client, a Go program of `nox-threads`; claude-code: questions and permission requests through the asks | 3 |
+| 5 | Every session runs in a sandbox of its own that reaches only the vendor and the bus, and the home server runs one too | tests 1 and 2 | mesh-catalog: the sandbox module (microsandbox pinned, KVM loaded where off); `nox-thread-handler`: runs sessions in it; claude-code: writes the login and the licence token without its refresh part | 3 |
+| 6 | Every person, agent and module is an identity with a role, and an agent's call outside its role is refused, saying which grant is missing | — | mesh-catalog: the identity seat's module; mesh-sdk: the tool runner's exact check, calls carrying thread and agent token; mesh-controller: an identity asked for each assignment; mesh-tools: sessions call as a person or an agent, never through the tool runner's login | 1 |
+| 7 | A dangerous act not named in a role comes to the operator as an ask, and the sealed break-glass agent opens only on the operator's word or a named condition | test 5 | mesh-sdk: dangerous calls asked; identity module: dangerous tools granted by name on an ask, break-glass and its telling | 6, 5, 4 |
+| 8 | The bus checks signed logins on a second bus beside today's, the identity seat signs and revokes them, and the switch, run in the lab on the mesh's own modules, loses nothing | test 4 | identity module: signing keys, renewal, revocation read back and resent to new servers; the node-engine (`mesh-host`): node and module logins renewed; mesh-controller: the second bus as a leaf with the system account; mesh-lab: the bed test from the branch `research/053-signed-bus-logins` | 6 |
+| 9 | Every identity is on the new bus, its data moved by copy, and today's bus is switched off | — | mesh-controller and the identity module: one identity at a time, then streams, buckets and the object store; mesh-catalog: the old bus's module retired | 8 |
+| 10 | The operator follows and answers threads from the web page as from the terminal client, logged in as a person identity | — | mesh-catalog: the web page, a client of the thread seat over the bus's WebSocket listener | 9, 4 |
+
+The front ends' later parts, the inference seat and the other agent harnesses are tracked by issue 850; the
+seat-sense "role" in older designs by issue 872.

03-DESIGN/01-to-be/README.md

@@ -57,6 +57,7 @@ document is written and this one's status becomes `implemented`.
 | [`55-the-knowledge-base.md`](55-the-knowledge-base.md) | **Designed.** The mesh keeps its decision records and research efforts whole in one module, `mesh-knowledge`, on the control-node: number, status, topic, typed links both ways, each decision's clauses with their own status, and the reasoning, with every version; a record is proposed, checked at the write, reviewed by the knowledge base's own judgement and accepted there, with the operator's Approve when it needs it; agents ask what holds in one bounded call | ADR 0290 |
 | [`56-the-mail-client-set-up-by-the-mesh.md`](56-the-mail-client-set-up-by-the-mesh.md) | **Designed.** On every node with a display server, the `betterbird` module installs Betterbird from a pinned upstream release mirrored into the artifact store, ships the Owl add-on pinned and installed by Betterbird's enterprise policy, and declares the operator's mail accounts in a trusted setting without credentials; each account signs in once at a person's first use, and one the profile already holds is adopted by its address | ADR 0316, ADR 0317 |
 | [`57-building-config-and-provisioning.md`](57-building-config-and-provisioning.md) | **Designed.** The work of ADR 0348 and ADR 0349 as 37 packages, each an issue with its proof: foundations, template files, config in its own module, the provisioner and its client, secrets in the vault, bindings from providers, collections, a module's runtime readers, and removing the old forms; at most five worked at once | ADR 0348, ADR 0349 |
+| [`58-agent-work-as-the-meshs-own.md`](58-agent-work-as-the-meshs-own.md) | **Designed.** Agent work as the mesh's own: a thread seat keeps every thread whole on the bus; a thread handler runs the harness headless in a sandbox per session, the workspace on the thread's own forge branch; a workspace toolkit and named tools, no general command runner; one identity seat for persons, agents and modules, roles of grants, every tool an effect, signed bus logins, and the switch to them one identity at a time | ADR 0383, ADR 0384, ADR 0385, ADR 0386, ADR 0387, ADR 0388, ADR 0389, ADR 0390 |
 
 ## Not yet written