coordination-engine/docs/adr/002-worker-runtime-boundary.md

ADR-002: Worker runtime and TAMQ boundary

Date: 2026-09-07. Status: accepted. The operator approved the local deployment defaults and canon-review scope transfer recorded in WP-0003-T02/T04.

The implemented tmux-amq/spec/coordination-engine-adapter-v0.1.md supersedes the original speculative inbound TAMQ attach handshake in this repository. The coordination process is a client of TAMQ's same-user Unix socket. TAMQ owns endpoint registration, tmux lifecycle, gita slug/path verification, its tamq executable, delivery policy, queue history, export/replay, and unsafe diagnostics.

This repository packages a separate coordination-engine executable and does not install a conflicting tamq command. Its control socket handles worker acknowledgements, renewals, checkpoints and local status. No second endpoint registration protocol is introduced. TAMQ endpoint/message IDs are preserved in coordination leases and sanitized receipts.

The first runtime uses Python 3.11+ and standard-library components. It speaks the published TAMQ JSON socket protocol directly, so installation does not need a sibling checkout or a private package index. A fake-peer integration suite asserts the exact capability negotiation and idempotent send envelope. TAMQ remains the authority for its wire contract.

The runtime uses explicit repository selection and the conservative default policy. Operator-approved operational defaults are the existing contract's 15-second poll, 30-second lease, 10-second renewal, four attempts and 5/15/60/300-second retry delays, same approved local user, mode-0600 sockets, private XDG state, retained history, and pre-migration SQLite backups. See docs/worker-runtime.md for the complete example. No service has been enabled.

Checkpoint continuation and transport recovery have different identities: transport recovery repeats the same lease and prompt, while a checkpoint ends its lease and creates a new trigger/lease linked to the original. This preserves TAMQ admission deduplication without suppressing a deliberate continuation.

Canon ownership remains with info-tech-canon. The proposed Orwell practice is recorded in docs/orwell-logging-diagnostics-candidate.md; no canonical status or owner disposition is claimed by this repository. The operator approved tracking owner review/registration separately in COORDINATION-WP-0004; it no longer blocks closure of the implemented worker runtime.