Sensorium Interfaces¶

Based on:

doc/project/40-proposals/082-sensorium-interfaces.md
doc/project/40-proposals/083-sensorium-interactive-interfaces.md
doc/project/40-proposals/045-sensorium-local-enaction-stratum.md
doc/project/40-proposals/047-classification-label-propagation.md
doc/project/40-proposals/070-room-primitive.md
doc/project/40-proposals/071-sensorium-workbench.md
doc/project/40-proposals/081-horizontal-protocol-primitives.md
doc/project/60-solutions/023-artifact-delivery/023-artifact-delivery.md
doc/project/60-solutions/030-sensorium/030-sensorium.md
doc/project/60-solutions/035-interaction-broker/035-interaction-broker.md
doc/project/60-solutions/036-room/036-room.md
doc/project/60-solutions/042-sensorium-workbench/042-sensorium-workbench.md
node:sensorium-interface-core
node:daemon/src/sensorium_interface_runtime.rs
node:daemon/src/sensorium_interface_remote_feed.rs
node:daemon/src/sensorium_interface_runtime/actuation_runtime.rs
node:daemon/src/sensorium_interface_room_projection.rs
node:daemon/src/peer_runtime_host.rs
node:daemon/src/host_capabilities_host.rs
node:tools/conformance/sensorium_interfaces_conformance.py
node:tools/acceptance/sensorium-terminal-live-feed/run.py

Related schemas:

sensorium-operational-context.v1
sensorium-interface-descriptor.v1
sensorium-interface-status.v1
sensorium-interface-read-request.v1
sensorium-interface-read-result.v1
sensorium-interface-subscribe-request.v1
sensorium-interface-subscription-command.v1
sensorium-interface-subscription-status.v1
sensorium-interface-frame.v1
sensorium-terminal-event.v1
sensorium-interface-remote-feed-request.v1
sensorium-interface-resource.v1
sensorium-interface-actuation-descriptor.v1
sensorium-interface-actuation-status.v1
sensorium-interface-actuation-grant-scope.v1
sensorium-interface-control-request.v1
sensorium-interface-control-status.v1
sensorium-interface-control-lease.v1
sensorium-interface-invoke-request.v1
sensorium-interface-invoke-receipt.v1
sensorium-interface-terminal-input.v1
sensorium-interface-terminal-resize.v1
sensorium-interface-terminal-signal.v1
sensorium-interface-led-set.v1
artifact-object-pointer.v1
classification.v1
capability-passport.v1
vendor-media-type-registry.v1
room-relay-delivery.v1

Status¶

Implemented observation and actuation MVP solution.

The carrier-neutral pull-batch core, durable host runtime, open bounded source adapter registry, Sensorium, Workbench, and Artifact Delivery source adapters, local host-capability surface, authenticated direct-peer surface, local SSE adapter, and WSS-backed Room latest-state projection are implemented. The runtime is refusal-tested for stale or revoked authority, cursor misuse, ordered-event Room projection, classification mismatch, and restart recovery. Host-local bounded metrics and the extended conformance runner provide the operator evidence surface needed for post-V1 delivery decisions. This implementation satisfies the explicit P082 hard-MVP release blocker. The P083 schema, capability, core, durable coordinator, LED, host/direct-peer, Workbench PTY, operator/Room collaboration, conformance, and synchronization slices are implemented and refusal-tested. P083-012 promotes that reviewed actuation extension into this solution and satisfies the P083 hard-MVP release blocker. P070 Phase 6A now also supplies the shared relay-epoch carrier used by the Room latest-state pump and the closed P083 status/claim/control/invoke/receipt classes; direct peer remains an optional latency path and owns no additional authority. P082-022 additionally completes a canonical exact-byte terminal event contract, bounded Workbench replay with explicit gaps and terminal end, an owner-bound recipient-side direct-peer feed, and local SSE presentation for both local and remote admitted subscriptions. Recipient-side peer egress requires the separate host-local sensorium.interface.remote-feed grant; source reads continue to require an exact signed sensorium.interface.subscribe Passport.

Date¶

2026-07-22

History¶

This solution promotes the frozen and implemented Proposal 082 contract into a separate component. Proposal 082 remains the observation rationale and tracker; Proposal 083 remains the actuation rationale, invariants, and post-MVP tracker. P083-012 promotes its implemented hard-MVP boundary into this solution. This solution owns the combined implementation boundary without introducing a second publication, grant, revocation, or authority service.

Executive Summary¶

A Sensorium Interface is a host-owned, explicitly published directional projection of or input surface for an enacted representation. The promoted observation plane gives authorized local components or remote peers one bounded pull family:

publish source projection
  -> authorize exact interface resource
  -> read one bounded batch or open a bounded subscription
  -> pull the next batch through a carrier adapter

The resource is not a connector, transport, store, or capability. Sensorium, Workbench, and Artifact Delivery own or admit source facts. Interaction Broker owns bounded source observation. The Sensorium Interfaces runtime owns publication, grants, subscriptions, cursors, classification checks, lifecycle, and revocation. Direct peer, SSE, and Room WSS are edge adapters and never become authority.

The implemented V1 delivery contract is bounded cursor-based pull-batch. Local and direct-peer live terminal views are projections over that same contract: the recipient host advances the admitted subscription and presents batches through loopback SSE rather than introducing provider push or carrier authority. A Workbench retention gap is projected before retained events, while recipient reconnect forwards its stale cursor and preserves the source-reported gap. The real guest proof keeps two PTYs live together and demonstrates that their bytes and cursors remain isolated. Provider push, global descriptor discovery, and automatic stream persistence are outside this solution's MVP boundary.

The promoted actuation plane adds a separate bounded effect family:

publish effect adapter
  -> authorize exact interface methods
  -> read grant-gated status and claim fenced control when required
  -> invoke with current source generation and lease epoch
  -> return a metadata-only evidence-classified receipt

Observation authority never implies actuation authority. A collaboration carrier, Room membership, or control lease cannot replace the exact active interface grant. Ordinary Corpus deliberation requires neither plane. An admitted Sensorium Interface is an optional context or effect channel for a consumer that needs an enacted representation; it does not define the problem domain or confer authority through participation alone.

Proposal 083: Sensorium Interactive Interfaces defines the promoted actuation rationale with separate resources, grants, coordination, and fencing. Its implementation reuses this component's core, authority runtime, store, admission, fact, receipt, classification, adapter, and carrier boundaries. P083-012 records the final review and promotion into this solution.

Context and Problem Statement¶

Sensorium observations, Workbench terminal representations, and admitted Artifact Delivery pointers need a shared way to be deliberately exposed without giving consumers access to connector credentials, terminals, or private provider stores. Implementing each exposure as a separate stream API would duplicate authorization, cursor, replay, classification, revocation, and backpressure semantics.

Sensorium Interfaces provides one contract above the producer-specific adapters and below carrier-specific presentation. This keeps a temperature snapshot, a Workbench terminal screen, a bounded terminal event batch, and an immutable artifact pointer structurally comparable while preserving their distinct schemas and delivery semantics.

Proposed Model / Decision¶

The solution is stratified as:

sensorium-interface-core
  schemas, lifecycle, delivery semantics, cursor binding, limits,
  classification and declassification validation

Interaction Broker source-provider adapter
  one domain source, generic private bindings, bounded adapter registry,
  source-specific validation and batch production

daemon Sensorium Interfaces runtime
  publication, grants, subscriptions, immutable management facts,
  idempotency, restart projection, revocation and inspection

carrier adapters
  local host capability, direct authenticated peer, local SSE,
  WSS Room latest-state projection

Only the runtime may translate current resource authority into a read or subscription. A cursor is change/replay state, not a bearer token. A carrier session is presentation state, not a grant. Every batch rechecks current caller, resource, lease, classification, limit, and revocation constraints.

Must Implement¶

Contract and Pure Core¶

Responsibilities:

own the eight closed Sensorium Interface schemas and typed semantic errors;
enforce one-shot versus subscription shape, cursor binding, terminal status, latest-state no-replay, ordered-event replay bounds, and independent frame and batch byte caps;
require classification.v1 on every frame and exact payload-label equality when a payload embeds classification;
accept declassification only for Surface::Interface with the descriptor's exact topic class and current fact validity;
keep the core independent of daemon, transport, SQLite, async runtime, and concrete providers.

Status: done.

Optional Sensorium Web latest-state adapter¶

P084 adds sensorium-web-latest-state through the existing open bounded source registry. It is registered only when the sensorium-web middleware module is configured and is deliberately not a fifth required built-in. The adapter reads only an already admitted latest snapshot, rechecks source/generation and the canonical snapshot digest, coalesces an unchanged cursor to no-change, and has no refresh method. Existing local SSE, direct-peer, and Room carriers therefore remain transport projections rather than acquisition authority. Dedicated real TLS peer read/subscription and local Room WebSocket acceptance now closes P084-008 with exact Passport scopes, dual Room/interface authority, revocation, generation fencing, explicit supersession and remote-refresh refusal. The Room fixture supplies admitted membership facts; this does not claim federated relay or remote membership issuance. Evidence is retained in node:docs/evidence/sensorium-web/SENSORIUM-WEB-REMOTE-INTERFACE-EVIDENCE.md. The strengthened 1.2.0 profile run also proves secret-canary absence in operator/carrier data and real retained artifacts; link query values are removed before digest binding. Its explicit profile migration requires a new generation and fresh publication authority. Full capacity, controlled failures and the combined review close P084-009 in node:docs/evidence/sensorium-web/SENSORIUM-WEB-STATIC-ACCEPTANCE-EVIDENCE.md; P082 hard-MVP readiness is unchanged. The real macOS local read/SSE slice is retained in node:docs/evidence/sensorium-web/SENSORIUM-WEB-LOCAL-INTERFACE-EVIDENCE.md: admitted payload/digest binding, no-change, changed snapshots, revocation, generation fencing, and explicit supersession requiring fresh grants, with zero consumer-triggered fetches.

P084-012a also composes this adapter with local Harvester intake. An operator session configures an immutable source binding, but each selected-snapshot import still requires an independent current interface read grant. The bridge verifies the retained document-block artifact and repeats admission after artifact I/O; findings preserve source classification and exact provenance. It adds no refresh, remote handoff or publication path. Evidence: node:docs/evidence/sensorium-web/SENSORIUM-WEB-HARVESTER-EVIDENCE.md.

P084-012a review hardening¶

Review H-1 through H-10 distinguishes pre-claim not-started refusal from settling an already claimed operation, using the same refresh-status contract and failure semantics. A bounded refusal projection isolates the rejected source generation and makes its reason visible without consuming operation slots or starving healthy sources. The 1.2.1 extraction revision computes link truncation after deduplication. Harvester configuration equality is semantic; no-op registration returns HTTP 200. Safe host trace categories preserve refusal causes, and the post-artifact read uses its own causal child operation without extending the original deadline. Evidence: node:docs/evidence/sensorium-web/SENSORIUM-WEB-HARVESTER-REVIEW-EVIDENCE.md.

Source Adaptation¶

Responsibilities:

expose one sensorium-interface source kind through Interaction Broker;
compose source authority with interface authority rather than allowing either to stand in for the other;
adapt admitted Sensorium observation latest state;
adapt Workbench terminal screen latest state separately from ordered terminal events;
admit immutable Artifact Delivery object pointers through a read-only artifact-snapshot latest-state adapter;
keep source-specific validation and production behind a bounded registry and revalidate persisted bindings after restart;
revalidate current publication and source bindings after successful or failed provider I/O so terminal generation and supersession failures retain their interface type across the consumer-neutral broker boundary;
require all four built-in adapters at daemon startup while treating readiness snapshots as advisory and each bounded source read as authoritative;
preserve source classification and apply redaction before publication.
validate Workbench terminal output as exact bytes with matching digest/count, preserve explicit retained-floor gaps, and map terminal source closure to one terminal batch without advancing past unconsumed capped events.

Status: done.

Host Runtime and Authority¶

Responsibilities:

implement publish, suspend, withdraw, grant, revoke, inspect, subscribe, renew, close, and read-next lifecycle operations;
register sensorium.interface.read, sensorium.interface.subscribe, and the host-local sensorium.interface.remote-feed and sensorium.interface.manage capabilities;
persist immutable management facts and rebuild disposable publication, grant, idempotency, and subscription projections after restart;
bind grants and subscriptions to canonical namespaced actor refs, exact interface ids, capability class, expiry, lease, and current revocation evidence;
serialize cursor advancement per subscription without blocking independent subscriptions, and admit a verified Passport in one immediate transaction;
append canonical causal context and execution receipts without treating either as authority.

Status: done.

Carrier Adapters¶

Responsibilities:

expose local host-capability reads and management through authenticated host caller binding; derive module:<module-id> from that binding consistently for capability admission, causal-context validation, feed ownership, and local SSE, rather than accepting the request body's actor as authority;
admit direct-peer requests only after signed Capability Passport validation against sensorium-interface@v1, exact authenticated remote target, local source-node issuer, resource, operation, classification ceiling, batch caps, lease, and revocation freshness;
expose local SSE only over loopback and only for an already admitted, caller-bound subscription;
allow a recipient-side direct-peer feed only with local remote-feed authority, then select an active signed subscribe Passport for the authenticated source node, pin the returned resource, subscription, delivery kind, and caps, and expose it only to its creating local caller through loopback SSE;
bound every peer wait to five seconds, reject WSS messages above 1 MiB before application decoding, and measure the result against requested batch.bytes_max before typed deserialization; retry only transport unavailability;
register a consumer-side integrity validator for every inline schema that carries byte-evidence and re-compute its count and digest before presentation;
identify SSE and Room projection read-next operations separately in canonical causal context;
project WSS Room views as a dedicated latest-state session whose recipient set is the intersection of current Room observation rights and current Sensorium Interface grantees, matched only by canonical Room subject key;
omit source cursors from Room frames, refuse ordered-event interfaces, and close only the projection session on terminal or revoked authority;
cap active Room projection pumps at 64 and reap terminal pump and carrier state together before admitting replacement work;
keep pump intent process-local: source-host restart requires an explicit local projection restart, while recipient restart can refresh the relay's bounded current latest-state delivery without durable Sensorium pump state.

Status: done.

Acceptance and Operator Evidence¶

Responsibilities:

prove one-shot and subscription temperature flows, revocation, terminal status, idempotent replay, and restart rebuild;
prove a signed direct-peer request through the standard peer message chain;
prove exact Passport target binding, concurrent idempotent Passport admission, revoked-Passport replay diagnostics, and independent per-subscription read locks;
prove that the Passport scope tier vocabulary remains aligned with the shared classification lattice and that schema-gate rejects structurally conflicting frame payload sources;
prove local SSE batch delivery and terminal close after grant revocation;
prove exact non-UTF-8 terminal bytes, bounded Workbench retention gaps, terminal end, owner-bound direct-peer cursor advancement, and remote pull-batch projection through local SSE;
prove collaborative Workbench terminal-view projection through Room WSS, including recipient revocation and durable Room survival;
expose schemas and the local SSE route through the daemon API projection;
expose a host-local operator snapshot with bounded source/carrier/delivery-kind dimensions, batch occupancy, no-change, encoding-error and read error counts, active leases, Room pump counts, and flat local revoke transaction commit duration;
degrade unavailable source-registry, active-subscription, metric-accumulator, and Room telemetry as isolated snapshot sections rather than failing the read-only operator action;
run one conformance harness across bounded host load, signed direct-peer reads, SSE revocation, and Room projection revocation;
keep external denial details generic while retaining local diagnostic traces.

Status: done.

Actuation Foundation¶

Promoted responsibilities implemented through P083-011 and closed by P083-012:

extend the common resource envelope with closed per-method actuation descriptors, control leases, invoke requests/receipts, exact grant scopes, and Workbench input schemas;
register Passport-eligible sensorium.interface.invoke with the exact sensorium-interface-actuation@v1 profile while keeping action-enumerated sensorium.interface.manage source-local;
reuse the pure core and durable authority runtime for bounded shared ordering, exclusive claims, lease epochs, handoff, preemption, generation fencing, content-bound idempotency, restart, revocation, inspection, aggregate metrics, and a symmetric 16 MiB read/write cap on each serialized coordinator projection;
keep read-source and effect-adapter traits separate while reusing bounded registry mechanics, including fail-closed duplicate, unavailable, unknown, and over-cap behavior; adapter readiness is a health hint, while effect-time provider state is authoritatively checked by apply;
expose host-local and authenticated direct-peer actuation without deriving authority from observation or carrier attachment;
route Workbench terminal input, resize, and signal through exact schemas and a remote-caller control authority that reaches the PTY boundary without impersonating the operator; provider-confirmed terminal closure withdraws the actuation source, changes its opaque generation, and clears transient control;
persist metadata and digests rather than raw actuation payloads, report honest unknown outcomes for uncertain irreversible effects, and keep evidence refs opaque from private Workbench session bindings;
expose strict manage actions over a bounded process-local Room collaboration group registry and reuse existing grant, inspection, and preemption surfaces;
keep P070's 256-bit Room session bearer outside messages, acknowledgements, shared observations, collaboration-group state, and operator/member status;
derive collaborative callers and current actuate membership atomically from one live Room transport snapshot, and intersect it with exact interface, method, generation, lease, epoch, sequence, and host policy authority;
keep observation authority separate, expose bounded claim polling hints, lose ephemeral groups fail-closed on restart, remove explicit withdrawals immediately, reap closed/terminal Rooms before group access or inspection, preserve Room-scoped groups across one member-session disconnect, and never relay terminal bytes as Room messages;
run the expanded exact-name conformance matrix across load saturation, expiry, renewal, handoff, stale epochs, restart, partial failure, Room dual authority, and two controllers writing through a real Workbench PTY.

Status: done.

May Implement¶

Relocatable Room Relay Carrier¶

P070 Phase 6A implements the authority-neutral Room relay as the default firewall-proof carrier contract for collaborative latest-state and P083 interaction whenever an active endpoint is projected. The P082 adapter keeps its source cursor private: (relay/epoch, relay/seq-no) is only carrier resume state, and failover or carrier cursor expiry triggers a fresh current-state read after current Room and interface authority are rechecked.

P083 status, claim, control, invoke, and receipt use the same coordinator contracts and fencing over the relay. Authenticated direct peer remains an optional latency upgrade, not a lease or correctness requirement. This work is owned by P070 Phase 6A plus P082-020/P083-013; it must not create a Sensorium-specific relay or NAT traversal protocol.

Status: done post-MVP through P070 Phase 6A, P082-020, and P083-013. The relay transports typed requests and receipts but never executes an effect or supplies authority on behalf of the destination host.

P082 latest-state relay publication uses the closed sensorium-interface-read-result.v1 resource envelope with one inline cursor-free snapshot, not a bare frame. The destination host may expose that resource through Interaction Broker only under an exact host-component context. The Story 012 daemon resolver maps a statically bound opaque Agent observation source to this adapter, then rechecks Room membership generation, relay epoch, exact interface authority, schema, classification, freshness, and byte bounds around the broker read. These Room/Sensorium axes remain private to the daemon; agent-core contains only the generic need/binding/evidence contract and reuses the horizontal P081 causal context without importing Sensorium semantics. Observation content remains process-local and passage-bounded; durable broker and Agent records retain no raw payload.

Story 012 receives the delivery through an authenticated Room subscription and compares its epoch with the relay acknowledgement rather than deriving both sides from the local inbox. After the broker read it opens a fresh bounded subscription to recheck the current relay epoch and current Room invitation before admitting the Agent passage.

Operational Impact Context¶

P082-021 and P083-014 implement a post-MVP extension of this same component. It publishes the ordered sensorium-operational-context.v1 value on an exact enacted resource, binds it to the current source generation, propagates both through P082 results and P083 status/receipts, and lets a consuming host raise but never lower the current source class. P082 defines stale solely as a generation mismatch or a superseded effective publication; impact changes and corrections use audited immutable replacement. Workbench-backed, collaborative-live, and remotely invokable profiles are not special cases: the V1 resource envelope requires the value for every publication. The earlier wire-optional rollout path was deliberately not used. Every profile therefore fails closed when the value is absent, malformed, oversized beyond the 512-byte UTF-8 summary cap, inconsistent, or stale.

Room remains an opaque carrier. Agent Core retains only bounded generic qualifier refs and strict digests, while the daemon and P064 prompt-assembly boundary render a versioned, non-droppable caution layer before feed-dependent inference. Host-owned request metadata and the durable Inquirium trace pair each source class with its context digest and record the local policy ref, floor, and selected class. The trace consumes that composition-root projection directly, so local elevation remains auditable without entering Agent Core. The extension creates no capability, access grant, or effect authority and does not reopen the completed hard-MVP boundary.

The normalized publication slot is indexed by source kind/ref, projection profile, and direction. Replacement is serialized with read and effect admission, closes old subscriptions, requires a non-empty trimmed NUL-free reason capped at 512 UTF-8 bytes, emits bounded metadata-only correction facts, and makes stale generations and superseded ids typed refusals. Workbench environment generation and authority are exact; Story 012 exercises the collaborative replacement path. A Room pump that encounters generation or context drift publishes a recipient-filtered, transient suspended / degraded status before close without rewriting the durable publication. Revoking the last observer clears the transport audience before close, preventing bounded replay of the prior latest-state result.

Status: done post-MVP.

Measured Provider-Push Profile¶

The accepted baseline adds no provider-push or push-hint protocol. A future revision may reconsider one only if operational measurements show that bounded read-next cannot meet a concrete latency or cost requirement. It must be a separately acknowledged profile and share one authority-neutral, disclosure-bounded readiness-hint substrate with P083 rather than duplicate it. Each hint audience must pass the same current grant and applicable collaboration-policy checks as the corresponding read or claim, so notification leaks no unauthorized resource activity.

Status: deferred.

Searchable Descriptor Catalog¶

The accepted baseline has no searchable descriptor catalog. Caller inspection of interfaces already disclosed by current authority is not discovery and preserves leak-minimal lookup. A future existence-discovery catalog is a separate disclosure oracle and requires an explicit policy, query bounds, anti-enumeration posture, revocation model, and contract revision.

Status: deferred.

Split Management Authorities¶

The accepted baseline keeps one source-local, non-delegable manage capability. Current runtime dispatch and authorization policy enumerate the closed observation and actuation action vocabulary, including control.preempt; preemption also requires an active exact invoke grant before it can establish an operator lease. Any future capability split requires distinct-principal deployment evidence and a contract revision.

Status: deferred.

Trade-offs¶

Pull-batch adapters add polling latency but preserve one semantic contract and one revocation point across transports.
Exact resource grants make ambient discovery impossible, but materially reduce descriptor and sensor enumeration risk.
Room projection revalidates two authority domains per emission. This costs more than trusting membership, but prevents the carrier from silently widening observation rights.
The runtime serializes cursor advancement within each subscription to preserve deterministic read-next behavior, while independent subscriptions progress concurrently.
The MVP Room adapter owns one OS thread per projection for its bounded long-poll loop. A hard 64-pump ceiling prevents thread exhaustion; a shared dispatcher remains a measured post-MVP optimization.
Runtime metrics are process-local and reset on restart. This avoids creating a second durable telemetry store; representative evidence collection must export snapshots externally when persistence is required.

Failure Modes and Mitigations¶

Failure mode	Consequence	Mitigation
Cursor is replayed by another caller	Unauthorized observation or cursor corruption	Bind cursor and subscription to authenticated actor, exact interface, and current grant.
Grant or Passport is revoked during a stream	Continued observation after authority ends	Recheck revocation before source read and carrier emission; close with a typed terminal reason.
Room membership is treated as interface authority	Room member sees an ungranted terminal or sensor	Intersect Room `observe` rights with active interface grantees for every emission.
A bare grantee id collides across Room subject kinds	Authority for one principal widens to another namespace	Reject non-namespaced grantee refs at grant creation and intersect only canonical `RoomSubject::stable_key()` values.
Source reports `no-change`	Adapter mistakenly closes the stream	Preserve `no-change` as a non-terminal batch outcome.
Ordered events are projected through MVP Room WSS	Cursor leakage or false replay guarantees	Refuse attachment before starting the carrier pump.
Source or carrier exceeds bounds	Memory growth or oversized live frame	Enforce request, frame, batch, source-read, and Room-message caps independently.
Workbench evicts terminal events before a subscriber catches up	Silent loss or a cursor that falsely claims continuity	Persist a bounded retained floor and emit an explicit gap before the next available event.
A remote host returns malformed or mismatched terminal evidence	Recipient renders corrupted bytes or accepts another subscription's data	Schema-gate the complete read result and each inline payload, pin resource/subscription/delivery/caps, and verify output count and digest before SSE projection.
A local subscription grant is reused to initiate peer egress	Observation authority silently widens into network authority	Require separate host-local `sensorium.interface.remote-feed` authority, then independently require an exact source-issued subscribe Passport.
A peer stalls or returns an oversized or malformed result	A feed blocks indefinitely, allocates beyond its contract, or retries a terminal integrity failure	Bound peer wait and carrier bytes, enforce requested result bytes before typed decode, and retry only transport-unavailable failures.
A remote feed ref or cursor is reused by another local caller	Local authority is confused with possession of presentation state	Bind every feed to the authenticated creating module and recheck ownership on read and close.
Repeated Room projections exhaust host threads or retain terminal payloads	Resource exhaustion over time	Cap active pumps at 64 and reap terminal daemon and carrier entries together.
Resource lookup denial reveals existence	Descriptor enumeration oracle	Return one generic external denial and retain details only in local traces.
Daemon restarts with active subscriptions	Authority or terminal state drifts	Rebuild from durable facts and persisted subscription status before accepting work.
A source adapter disappears or its persisted config becomes invalid after restart	A stale publication bypasses current source policy	Revalidate the generic binding and current registered adapter before every source read.
Metrics acquire resource or caller identifiers	Unbounded cardinality or sensitive operational disclosure	Limit dimensions to at most 64 registered source kinds plus unresolved reads, four carriers, and two delivery kinds; expose only aggregate counters and timings.
Revoke transaction duration is presented as end-to-end enforcement lag	Operators receive misleadingly optimistic evidence	Expose the flat measurement as `revoke-commit-us`; enforce local and peer bounds through pull-loop and revocation-freshness budgets, and measure those boundaries separately.
One operator-snapshot source fails	Operator loses unrelated runtime evidence	Degrade source-registry, active-subscription, metric-accumulator, and Room sections independently to `unavailable`, log the local error, and keep core read paths independent from telemetry health.
Room membership is mistaken for actuation authority	A collaborator invokes an ungranted method or stale lease	Require current `actuate`, canonical session subject, exact active interface grant, grouped method, generation, and current lease fencing before dispatch.
A Room bearer is projected or echoed	Another member can reuse a session identity	Keep the 256-bit random ref only in the joining client's admission envelopes and bind frame subjects outside payloads.
Collaboration groups outlive their Room or occupy capacity after withdrawal	Process-local state becomes unusable or saturates	Remove withdrawals immediately; reap closed/terminal Room groups before access, management, and operator snapshots; clear all groups at daemon stop.
Terminal input is sent as an ordinary Room live message	Raw keystrokes bypass typed actuation admission or enter the wrong collaboration semantics	Carry input only as a schema-gated P083 relay delivery; retain it only in the bounded ephemeral epoch window, recheck the exact interface grant and fencing at the host, and persist only metadata/digests.
Relay or direct-peer upgrade is treated as control ownership	Carrier failover transfers or widens actuation authority	Keep grants and fenced leases in the host coordinator; carrier replacement changes transport only and must recheck current Room plus interface authority.

Open Questions¶

No unresolved design questions remain. Proposal 082 decisions 7-9 retain bounded pull-batch, direct authority-scoped disclosure, and one source-local manage capability. The deferred sections above are reconsideration boundaries, not open implementation choices.

Next Actions¶

Export representative snapshots from the implemented host-local metrics action and compare read-next latency, no-change rate, and batch occupancy by carrier, delivery kind, and source kind. Inspect flat revoke commit cost separately and measure enforcement at local carrier and peer freshness boundaries.
Add another producer adapter only when it can reuse the same classification, cursor, and authority contracts without a source-specific escape hatch.
Keep pull-batch, direct disclosure, and one source-local manage capability as the baseline. Require an explicit evidence-backed contract revision for any provider-push, existence-discovery, or management-authority split.
Collect P082-020/P083-013 relay latency, cursor-expiry, and failover evidence through the shared Room diagnostics rather than adding Sensorium-specific reachability or failover logic.
Add a multiprocess two-deployed-node direct-peer terminal-feed run only as stronger deployment evidence; retain the implemented peer-runtime transport test as the component-level proof and do not fork the live-feed contract.

P084-012b local review boundary¶

After P084-012a admission, the operator can supply an explicit redacted summary, topic, optional polarity and draft intent through the local Harvester web review API. weak-signal-web-review.v1 binds this immutable decision to the original finding digest; classification and snapshot provenance survive into an optional unpublished local Whisper draft. This consumes already admitted local evidence and grants no new P082 read, acquisition, remote delivery or publication authority. The bounded v3 review store records facts and projections atomically and rebuilds divergent review projections on reopen while validating retained facts. Explicit FK enforcement preserves parent bindings; safe HTTP classes distinguish invalid input, conflicting decisions, retained capacity and host failures. See P084 section "P084-012b: explicit web review and local draft" and node:docs/evidence/sensorium-web/SENSORIUM-WEB-REVIEWED-DRAFT-EVIDENCE.md for the contract, compatibility limits and measured acceptance. P084-012b is done for this bounded local slice. Broader P084-012 remains partial; the new slice does not close P078-007.

P084-012c operator review projection¶

The node-ui review surface consumes already imported findings and sends explicit operator decisions through the P084-012b API. Classification, provenance and the finding digest remain visible; draft creation requires an affirmative choice. Authentication and CSRF remain at the operator UI boundary and the daemon retains review authority, immutable facts and the unpublished local draft. The UI grants no fetch, P082 read or Whisper publication authority. Broader P084/P078 integration remains partial. P084-012c is done for measured local operator UI acceptance; see node:docs/evidence/sensorium-web/SENSORIUM-WEB-REVIEW-UI-EVIDENCE.md.