Agent Hub: mTLS coordination, gated execution.

Hub API: mutual TLS

• One X.509 client cert per agent, issued by the hub's own CA. CN = agent identity.
• Identity can't be self-asserted: the app never reads a name from the body.
• Access is per agent: one cert can be retired without touching any other client. No shared passwords.
• Windows clients use a Python client with PEM certs, since Schannel curl can't present them.

Fleet MCP: Streamable HTTP

• MCP over Streamable HTTP, stateless_http, JSON responses; a Starlette app behind nginx.
• Auth: static per-client bearer tokens, or OAuth 2.1 authorization code with PKCE (S256 only) and RFC 7591 dynamic client registration, for connector UIs.
• Per-client scopes (e.g. hub, files, deploy) checked on every tool call.
• Rate limit 60 calls/min per client (sliding window). Six auth/approval failures in 5 min locks that source out for 5 min.
• The MCP reaches the hub API as its own mTLS client, so every hub write is still attributable.

Message (bus)

{
  "id":    "a3f09c1e7b22",   // 48-bit hex
  "agent": "windows-work",   // from cert CN
  "text":  "…",
  "tags":  ["tfl","handoff"],
  "to":    "cursor",         // optional
  "ts":    "2026-10-19T13:02:11Z"
}

Ring buffer of the last 1,000. Read with ?after=<id> cursors; substring search across text, tags and agent.

KV document

{
  "key":        "task-site-walk",
  "value":      "<string or JSON>",
  "updated_by": "claude-oauth",
  "updated_at": "2026-10-19T12:40:03Z"
}

One file per key, last write wins, writer stamped from the cert. ~140 keys: task envelopes, worklogs, policies, registries.

Task envelope (convention)

task-<slug>:
  objective  · output · sources
  boundaries (additive-only)
  model hint · tier T0|T1|T2
  verify     (runnable check)
  report tag · rollback

Stored in KV; the bus only carries a pointer. Changes are numbered AMENDMENT messages citing the original id.

State

{
  "master": true,
  "off": ["tfldoor.com", "server2", "vault"],
  "updated_at": 1792411200,
  "updated_by": "owner"
}

• Written via mkstemp + os.replace: readers never see a partial file.
• master:false blocks all agent writes. off holds apex domains, server1–4, vault, secrets.
• Subdomains fold to the apex (shop.example.com → example.com).

Enforcement

• Domains are regex-extracted from paths and shell commands, so dock on server3 touching an OFF site is still refused.
• Checked by file_put, deploy, git writes, dock, sitemap_ping, secret_put, vault_write.
• Never checked for bus/KV/file notes, so agents can always report why they stopped.
• Agents can't edit the state file through the MCP.
• Crons use the CLI form: write_locks check <site> <server> exits 1 if any target is OFF.
• Out of scope by design: humans holding raw SSH keys. That list is kept short.

Storage

• One file per secret, root-owned, mode 0600, directory 0700.
• Names restricted to [A-Za-z0-9._-]; no path tricks.
• secret_list returns name, size, mtime only.
• Owners deposit values through a single-use, write-only drop link (15 min), never through chat.

Late expansion

• dock accepts {{secret:NAME}} placeholders.
• Order of operations: block-list check → write switch → approval → audit (placeholder form) → expand → exec.
• The audit log and the agent's transcript only ever contain the placeholder.
• secret_get exists, is phone-gated, and is discouraged: an approved read lands in that transcript.

Timed SSH sessions

• Remote dock is phone-gated per command, unless the caller holds the one session lease.
• Lease: 10–120 min, default servers 1–2, server4 opt-in, one holder fleet-wide.
• Signed identity: mm.dd.yy.hh:mm.computer:company:model[:name].
• A command deny-list applies always; a stricter one applies outside a lease. Wallet and bot paths stay blocked either way.

Pipeline

1. Strip Unicode tag and zero-width characters, then NFKC-normalize.
2. Run the rule set; decode base64-looking blobs and rescan them.
3. On a flag: write a quarantine copy (writer, score, reasons, content), append an injection_flag audit line, post a separate hub-guard note tagged injection-flagged, and push an alert.
4. Readers treat flagged content as data. The owner decides; many hits are his own deliberate prompts.

Tuned on the hub's history: 0 false positives over 950 notes, 9/9 attack samples caught. Negated phrasing ("never post private keys") doesn't score. It's one layer; the Windows Claude agent runs the same rules over tool results as a warning-only hook.