Context (graduation lineage)
Pillar-level sub-epic under Epic #13012 (the Agent Harness), executing the coordination-track decomposition recorded at graduation: Discussion #10119 → the #13012 §6.6 Signal Ledger rows "Coordination track: tool-surface design / isolation-conflict semantics / auth model" — each disposed [GRADUATED_TO_TICKET] under the family-keyed quorum (Claude [AUTHOR_SIGNAL] + GPT [GRADUATION_APPROVED]). This body files the umbrella those rows graduated into; its leaf subs land incrementally via ticket-create as each design converges. Sibling precedent: #13015 (Fleet Manager MVP) — the pillar-level sub-epic shape (operator: "we do not want 50+ subs" → pillar sub-epics, leaves under them).
Why an Epic, not a single ticket: three coordinated-but-separable design surfaces (transport auth, write-coordination, tool-surface curation) plus one glue obligation share one architectural spine (the identity-bound extended Neural Link) but are each one-PR-leaf-decomposable. Bundling them into one ticket would violate the leaf-sub close-target contract and force mid-review splits.
Problem scope (empirically grounded — substrate audit 2026-06-13, session 25c41da5-8ba5-4df8-8a61-29a7879b8b41)
The Neural Link is single-agent-trusted-localhost by construction; H3 (assistant-to-institution) makes it multi-agent, and the harness makes it a product surface. Audit findings, file-grounded:
- Transport has no identity: the Bridge (
ai/mcp/server/neural-link/Bridge.mjs, ws :8081) identifies clients by a role query parameter. No auth, no isolation primitive: every connected agent receives every app broadcast; any agent can target any app via the routing envelope.
- Writer nondeterminism:
ConnectionService.call() auto-targets the most recent session when no sessionId is passed (ai/services/neural-link/ConnectionService.mjs:103-107) — correct for one agent, a cross-writer footgun for two.
- Flat tool surface:
openapi.yaml exposes 37 operations with no read/write/admin tiering — 8 are mutation-class (patch_code, set_instance_properties, modify_state_provider, simulate_event, set_route, reload_page, manage_neo_config, manage_connection). Harness-embedded agents need a curated projection, not the full dev surface.
- Silent mutations: NL mutations emit nothing into the shipped A2A mailbox/wake substrate — peers cannot observe each other's live-heap writes.
- The co-habitation premise (ADR 0020 §1) makes this load-bearing: agents and humans mutate the same live App-Worker heap. Scenario-C (two writers, one app) is the category bet's hard part, and #13012 guardrail #1 binds: Topological Locking before any multi-writer slice — or the slice explicitly stays single-writer.
Intended solution shape
- Identity-bound transport: the Bridge handshake authenticates agent connections against the Fleet Manager credential store (#13031 → PR #13037) — one credential schema, registry-side, two readers (the one-schema pattern proven at #13041/PR #13050). PATs never transit the browser (ADR 0020 §3); the working hypothesis is registry-minted short-lived session tokens for agent↔Bridge auth (credential-class design input in flight).
- Topological Locking: write-class operations acquire locks keyed to
(AgentIdentity, harness-native canonical session_id) — the id substrate is #12984's contract (its consumer row is requested). Working direction: component-subtree granularity, with in-heap (App-Worker) enforcement as the authoritative layer — the heap is the shared truth; Bridge-level checks are advisory routing, never the lock authority. Placement + granularity finalize in the locking leaf's own Contract Ledger.
- Curated tool surface: the flat surface gains tier metadata (read / write-locked / admin) and harness-embedded agents get a narrowed projection; the curation contract is the tool-surface leaf's Contract Ledger.
- Mutation observability: NL-mutation→
MESSAGE emission glue rides the first coordination slice (resolved-shape per the #13012 ledger — not a separate sub).
- Auto-targeting deprecation: explicit target becomes mandatory when more than one session is live — lands with the locking leaf.
Discussion Criteria Mapping
Local mapping of the inherited coordination-track criteria (source: Discussion #10119 → #13012 §6.6 Signal Ledger [GRADUATED_TO_TICKET] rows; the parent #13012 carries the broad mapping) onto this sub-epic's four delivery surfaces — so each leaf author knows which graduation criterion it closes rather than re-inferring it one PR at a time. Added per @neo-gpt's epic-review Stage-2.5 Required Action (2026-06-13); steward picked up by @neo-opus-ada after the source author (@neo-fable / Mnemosyne) was benched on the Fable-5 access suspension (#13060).
| Source criterion / parent row |
#13056 disposition |
| Tool-surface design |
Curated tool surface leaf: classify Neural Link operations as read / write-locked / admin; define the harness-visible projection contract so embedded agents do not inherit the full developer surface by default. |
| Isolation / conflict semantics |
Topological Locking leaf: define lock key, component-subtree granularity, in-heap authority boundary, explicit-target behavior, and the #12984 canonical-session-id dependency. |
| Auth model through extended NL |
Identity-bound transport leaf: registry-backed short-lived agent token (or a defended alternative); PAT never browser-side. |
| Observability shape |
NL-mutation → MESSAGE emission glue, riding the first coordination slice, with the shipped A2A/wake substrate as the consumer. |
Out of scope
- Fleet Manager surfaces themselves (#13015, #13049) — providers/consumers of this epic's contracts, not its content.
- Session-id canonicalization mechanics (#12984 owns them; this epic consumes via a
blocked_by edge on the locking leaf once that ticket exists).
- The transcript/markdown UI surface (#13018 lineage, #13045) and window-manager choreography (#13025/#13028/#13030).
- The Electron shell (#13033) and deploy plane (H4).
- Any wake/routing semantics keyed on model — boundary held per #13041/PR #13050's documented invariant.
Avoided traps / rejected shapes
- Bridge-level authoritative locking — rejected: the heap is the truth; transport-held locks desync from in-heap reality under reconnects and worker restarts.
- A parallel credential schema for NL auth — rejected: one-schema/two-readers (the registry is the source; precedent #13041 → PR #13050).
- Big-bang multi-writer enablement — rejected: guardrail #1 sequences locking before any multi-writer slice; until then every slice declares single-writer explicitly.
- A greenfield coordination protocol — rejected: the A2A mailbox + wake substrate shipped with v13; the glue emits into it rather than replacing it.
Related
- Parent: #13012 (native sub-issue link).
- Substrate this epic consumes: #12984 (canonical session id), #13037 (credential store), #13049 (FM lifecycle — spawner-side identity/credential injection).
- Design-input threads: A2A
MESSAGE:b32f43ac (@neo-opus-vega, id-coverage + lock-keying consumer row), MESSAGE:d9cfde54 (@neo-opus-ada, verify-only read path + credential class).
Release classification: harness line (board 13); post-v13 — not release-gating.
Live latest-open sweep: checked latest 20 open issues at 2026-06-13T01:53Z via the github-workflow MCP path (shell GitHub egress down this minute — the workflow-sanctioned equivalent); no equivalent ticket (closest kin: #13012/#13015, the parent and sibling pillar). A2A in-flight sweep: 17 messages across the herd window; no competing claim (this lane is plan-of-record-claimed since rev 11).
Origin Session ID: 25c41da5-8ba5-4df8-8a61-29a7879b8b41
Retrieval Hint: "extended neural link coordination identity-bound bridge auth topological locking curated tool surface multi-writer"
Context (graduation lineage)
Pillar-level sub-epic under Epic #13012 (the Agent Harness), executing the coordination-track decomposition recorded at graduation: Discussion #10119 → the #13012 §6.6 Signal Ledger rows "Coordination track: tool-surface design / isolation-conflict semantics / auth model" — each disposed
[GRADUATED_TO_TICKET]under the family-keyed quorum (Claude[AUTHOR_SIGNAL]+ GPT[GRADUATION_APPROVED]). This body files the umbrella those rows graduated into; its leaf subs land incrementally viaticket-createas each design converges. Sibling precedent: #13015 (Fleet Manager MVP) — the pillar-level sub-epic shape (operator: "we do not want 50+ subs" → pillar sub-epics, leaves under them).Why an Epic, not a single ticket: three coordinated-but-separable design surfaces (transport auth, write-coordination, tool-surface curation) plus one glue obligation share one architectural spine (the identity-bound extended Neural Link) but are each one-PR-leaf-decomposable. Bundling them into one ticket would violate the leaf-sub close-target contract and force mid-review splits.
Problem scope (empirically grounded — substrate audit 2026-06-13, session 25c41da5-8ba5-4df8-8a61-29a7879b8b41)
The Neural Link is single-agent-trusted-localhost by construction; H3 (assistant-to-institution) makes it multi-agent, and the harness makes it a product surface. Audit findings, file-grounded:
ai/mcp/server/neural-link/Bridge.mjs, ws :8081) identifies clients by arolequery parameter. No auth, no isolation primitive: every connected agent receives every app broadcast; any agent can target any app via the routing envelope.ConnectionService.call()auto-targets the most recent session when no sessionId is passed (ai/services/neural-link/ConnectionService.mjs:103-107) — correct for one agent, a cross-writer footgun for two.openapi.yamlexposes 37 operations with no read/write/admin tiering — 8 are mutation-class (patch_code,set_instance_properties,modify_state_provider,simulate_event,set_route,reload_page,manage_neo_config,manage_connection). Harness-embedded agents need a curated projection, not the full dev surface.Intended solution shape
(AgentIdentity, harness-native canonical session_id)— the id substrate is #12984's contract (its consumer row is requested). Working direction: component-subtree granularity, with in-heap (App-Worker) enforcement as the authoritative layer — the heap is the shared truth; Bridge-level checks are advisory routing, never the lock authority. Placement + granularity finalize in the locking leaf's own Contract Ledger.MESSAGEemission glue rides the first coordination slice (resolved-shape per the #13012 ledger — not a separate sub).Discussion Criteria Mapping
Local mapping of the inherited coordination-track criteria (source: Discussion #10119 → #13012 §6.6 Signal Ledger
[GRADUATED_TO_TICKET]rows; the parent #13012 carries the broad mapping) onto this sub-epic's four delivery surfaces — so each leaf author knows which graduation criterion it closes rather than re-inferring it one PR at a time. Added per @neo-gpt's epic-review Stage-2.5 Required Action (2026-06-13); steward picked up by @neo-opus-ada after the source author (@neo-fable / Mnemosyne) was benched on the Fable-5 access suspension (#13060).MESSAGEemission glue, riding the first coordination slice, with the shipped A2A/wake substrate as the consumer.Out of scope
blocked_byedge on the locking leaf once that ticket exists).Avoided traps / rejected shapes
Related
MESSAGE:b32f43ac(@neo-opus-vega, id-coverage + lock-keying consumer row),MESSAGE:d9cfde54(@neo-opus-ada, verify-only read path + credential class).Release classification: harness line (board 13); post-v13 — not release-gating.
Live latest-open sweep: checked latest 20 open issues at 2026-06-13T01:53Z via the github-workflow MCP path (shell GitHub egress down this minute — the workflow-sanctioned equivalent); no equivalent ticket (closest kin: #13012/#13015, the parent and sibling pillar). A2A in-flight sweep: 17 messages across the herd window; no competing claim (this lane is plan-of-record-claimed since rev 11).
Origin Session ID: 25c41da5-8ba5-4df8-8a61-29a7879b8b41
Retrieval Hint: "extended neural link coordination identity-bound bridge auth topological locking curated tool surface multi-writer"