# ADR-002: Worker runtime and TAMQ boundary

Date: 2026-09-07. Status: accepted. The operator approved the local deployment
defaults and canon-review scope transfer recorded in WP-0003-T02/T04.

The implemented `tmux-amq/spec/coordination-engine-adapter-v0.1.md` supersedes the
original speculative inbound TAMQ attach handshake in this repository. The
coordination process is a client of TAMQ's same-user Unix socket. TAMQ owns
endpoint registration, tmux lifecycle, gita slug/path verification, its `tamq`
executable, delivery policy, queue history, export/replay, and unsafe diagnostics.

This repository packages a separate `coordination-engine` executable and does
not install a conflicting `tamq` command. Its control socket handles worker
acknowledgements, renewals, checkpoints and local status. No second endpoint
registration protocol is introduced. TAMQ endpoint/message IDs are preserved
in coordination leases and sanitized receipts.

The first runtime uses Python 3.11+ and standard-library components. It speaks
the published TAMQ JSON socket protocol directly, so installation does not need
a sibling checkout or a private package index. A fake-peer integration suite
asserts the exact capability negotiation and idempotent send envelope. TAMQ
remains the authority for its wire contract.

The runtime uses explicit repository selection and the conservative default
policy. Operator-approved operational defaults are the existing contract's
15-second poll, 30-second lease, 10-second renewal, four attempts and
5/15/60/300-second retry delays, same approved local user, mode-0600 sockets,
private XDG state, retained history, and pre-migration SQLite backups. See
`docs/worker-runtime.md` for the complete example. No service has been enabled.

Checkpoint continuation and transport recovery have different identities:
transport recovery repeats the same lease and prompt, while a checkpoint ends
its lease and creates a new trigger/lease linked to the original. This preserves
TAMQ admission deduplication without suppressing a deliberate continuation.

Canon ownership remains with info-tech-canon. The proposed Orwell practice is
recorded in `docs/orwell-logging-diagnostics-candidate.md`; no canonical status
or owner disposition is claimed by this repository. The operator approved
tracking owner review/registration separately in COORDINATION-WP-0004; it no
longer blocks closure of the implemented worker runtime.