Architecture

Codex ─┐
Claude ┤
Cursor ┤  identity-bound MCP stdio facades
Gemini ┤                │
OpenCode ┤              ▼
Hermes ─┘        Unix socket (0600)
                      │
               HAI-Relay daemon
             ┌────────┼─────────┐
             ▼        ▼         ▼
          SQLite   HAI-MCP    ACP target
          + audit  authority   process

The relay is a transport and evidence boundary, not an authority. Passive messages are stored without starting the recipient. Task envelopes require a mission ID and lease ID, and the authority port must allow them before the ACP dispatcher starts a process.

The internal envelope borrows A2A concepts—agent identity, message, task, thread/context, artifact references, lifecycle state—without exposing a network A2A server in v1.

Trust boundaries

The MCP facade fixes the caller identity at process launch. No public tool has a from_agent field.
The Unix socket is local and owner-only (0600). Same-user malicious processes remain outside the v1 threat model.
Authority errors and absence fail closed for tasks.
state_changing requires both target Claude and guarded assurance.
The ACP client denies permission requests. Host-action authorization remains the responsibility of HAI-MCP's maintained guarded adapter.
No chain-of-thought, transcript mirroring, broadcast, or automatic memory/KG ingestion is implemented.

HAI-MCP authority port

HAI-Relay calls an optional subprocess authority adapter with a JSON request describing mission, lease, caller, target, and operation mode. When no adapter is configured, or when the adapter is unavailable, tasks are blocked with a stable error code. The relay does not embed HAI-MCP or claim live integration.

Health dimensions

Agent registry entries expose three independent signals:

configured: adapter binary exists on PATH
enabled: policy permits use (always true for core six in v1)
worked_live: bounded real invocation succeeded recently (false until live gate)

These must never be collapsed into a single green indicator.

Out of scope (v1)

Global MCP/client configuration changes
Broadcast and group autonomy
Public A2A HTTP endpoint
Automatic Knowledge Graph or memory ingestion
State-changing execution on agents other than guarded Claude