Armonia: one shared coordination service, people as principals, distributed execution sites #1872

Acceptance Criteria

• A request without a valid person or site credential is rejected at every entry point; every accepted request carries a resolved principal.
• Every session and every admitted prompt records the authenticated person who created or sent it, and that attribution cannot be set or changed through client-supplied metadata.
• A person sees sessions, events, work requests, and artifacts only for environments they belong to, minus any projects that restrict them.
• Only a session's owner or an invited collaborator can prompt, abort, or answer permission requests in it; everyone else with visibility can observe.
• A campaign stops issuing provider turns, tool calls, and job submissions when its budget or stopping condition is reached, regardless of what the model requests.
• A delegated work request draws from its originator's budget, carries no broader permissions than the originator, and survives a coordinator restart.
• An execution site that disconnects and reconnects mid-job yields exactly one authoritative result for that job.
• A lab-site job is executed only if Strumento accepts it; a Strumento rejection or approval requirement is reported as such, never retried around.
• Two people on separate machines complete the end-to-end acceptance scenario against a private EC2 deployment using Bedrock with an instance role.

Testing Decisions

Each slice extends the suite that owns its seam (engine server/session/permission tests, the service runner and frontdoor tests, amico-run executor parity fixtures, the Strumento record-bridge fixtures). The parent closes on one new two-person end-to-end test that runs against a real deployment, including injected disconnects and restarts.

Key Decisions

• Principal, not machine. Peer and site tokens remain for machines, but every user-facing action resolves to a person. Machine credentials never stand in for a person.
• The frontdoor authenticates; the engine verifies. The edge resolves the person and forwards a signed principal; engines reject any principal they cannot verify, so bypassing the edge grants nothing.
• Environment is the membership boundary. Projects can only narrow access. Membership is a server-side record, not editor workspace state or environment variables.
• Owner + collaborators. Observation follows membership; control requires owner or invitation; every instruction and approval is attributed.
• Authority outside the model. Campaign budgets, tool allowlists, and stopping conditions are checked by the server before each provider turn, tool call, and submission.
• Delegation is a record. A work request names deliverable, acceptance checks, budget slice, permission set, and assignee; it is leased, fenced, and visible.
• Sites dial out. Sites register with their own credential and lease jobs by durable identity; reconnect reconciles rather than resubmits.
• Hardware authority is lab-side. Coordinator approval is necessary but never sufficient for hardware execution.
• Training is opt-in per environment. Collaboration access never implies eligibility for post-training datasets.

Data Contracts

• Principal — person id, display name, deployment, credential kind (person | site | machine); immutable per credential.
• Membership — environment id × person id × role; project restriction lists narrow it.
• Session attribution — owner, created-by, collaborators; per prompt: author, admitted-at.
• Campaign authorization — owner, environment/project scope, budget (cost, provider turns, solves, wall time), tool allowlist, device access level, stopping conditions, consumed totals.
• Work request — id, originating campaign and session, deliverable, acceptance checks, budget slice, permission set, assignee, lease (holder, generation, expiry), state, result reference.
• Execution site — id, kind (agent worker | compute | batch | lab), capabilities, credential, health; Job — durable id, site, lease generation, state, result reference.
• Artifact reference — content hash, site of custody, provenance (job, session, campaign), access policy, verification status.

Constraints & Invariants

• Single writer for the session store in this deployment; no second coordinator against a copied store.
• No new routing authority beyond what The connective tissue: one authority for location + liveness — the five-router architecture is one bug with many costumes #1760 converges on — identity rides the existing edge and engine path.
• Every user-visible number and result keeps its provenance (who, which campaign, which site).
• An expired lease holder can never publish an authoritative result.
• Real-hardware execution stays disabled until Strumento's lab-side gate covers every hardware entry point.
• Nothing in the deployment is exposed to the public internet; access is private network plus person credentials.

Prior Art

• The hub frontdoor, sticky shard routing, and merged session listing; the gateway-secret middleware.
• Fleet Studio's grant model (observe, control, lifecycle-admin), the control request→approve flow, the generation fence, and peer tokens (ADR 0031–0034).
• The engine's Location-scoped permission service, subagent permission derivation, session lineage edges, and worktree support.
• amico-run's executor contract, capability warrants, and the coordination ledger's claim/heartbeat/release.
• The Strumento task-record bridge and the QICK job-server abstraction.
• Research Environment manifests and resolver; ADR 0012 and ADR 0021.

Source

• Design discussion 2026-10-25 (team engine brainstorm); companion external proposal "Autoresearch for Quantum Hardware".
• Related: The connective tissue: one authority for location + liveness — the five-router architecture is one bug with many costumes #1760 (one authority for location + liveness), Add durable Work Column record and lease journal #979 (durable record + lease journal), Fleet Studio: in-window, multi-machine sessions & workspaces #1436 / Fleet Studio B2b — remote peer-studio control + live streaming on the observation path #1540 (Fleet Studio), Amicode for the outside-lab researcher — the journey, the campaign repertoire, and the seven seams (codesign PRD) #679 (outside-lab researcher codesign PRD), vault writer: attributed team writes, schema check before write, quarantine on failure #1863 (attributed team writes), feat(protocol): autonomous R&D system v2 — one source of truth, protected self-improvement, verified compaction #1820 (autonomous R&D system v2).

Notes

• AMD/Lux, self-hosted inference, and post-training are downstream consumers of these contracts, tracked separately.