One local service.
One Surface.
Every client.

Current source is Effect RPC. The local consumer guide still mentions oRPC in places; implementation follows the checked source. No new REST routing, custom browser SSE bus, or second retry engine.

• Browser + generated CLI: dial the same daemon Surface over its framework WebSocket. Derive its route through the framework helper. CLI watch is valid on this streaming endpoint.
• HTTP agents: MCP tools/call and resources/read at /mcp. surface-mcp accepts an injected transport; mounting Streamable HTTP on Odu’s listener is integration work, not an existing one-call HTTP helper.
• Stdio MCP hosts: odu mcp becomes a connection/projection bridge to this daemon. It owns no run lifecycle or independent command implementation.
• CLI over MCP/HTTP also works in principle: Olai already has this pattern. A request/response endpoint must declare streaming:false; do not advertise watch/follow until the endpoint actually supports subscriptions.
• The initial CLI uses the framework WebSocket to keep live readers. Request/response HTTP clients use bounded run_wait calls; attention delivery does not require MCP resource notifications.
• HTTP/WebSocket/MCP are protocol faces of the same service, not a chain in which the browser has to call MCP.

Three local process roles; remote workers are a separate deployment of the execution package. The root owns runtime done/close and scoped lifetime. Presentation uses a supplied sink; extracting the engine must remove its current imports of CLI rendering.

user state / odu /
  runs / RUN_ID /
    manifest.json          # coordinator identity + checkout + endpoint
    events                 # durable sequence + attempt identity
    attempts / NODE_KEY / N / log
  service /
    requests / REQUEST_ID  # request → launch/retry receipt

checkout / .ci / …        # compatibility paths / aliases

The canonical host-local run catalog exists independently of the web service. Every coordinator registers before executing, including a conventional CLI launch while web is absent. The daemon derives its board from this catalog at startup, then reconciles live coordinators. This makes “all in-flight runs” concrete without filesystem scans of arbitrary checkouts.

Versioned schemas, encoded node keys, atomic publication, and guarded ownership live in RunHistory. One run's writer cannot overwrite another attempt. Service request persistence and execution acceptance must be reconciled by the same launch ID so a crash between spawn and receipt cannot duplicate work.

Historical per-checkout records remain readable through an explicit legacy importer; source checkout removal does not erase new canonical evidence. Pruning is run-addressed and reports expiry.

• Service → execution: RunLauncher takes an immutable launch request and returns an addressed receipt. The root binds it to the packaged coordinator via the framework spawn driver. Legacy CLI and web launch through the same entry.
• Live retry: service calls the existing coordinator Surface, which owns node reset and dependencies. Finalized retry uses recorded inputs to launch a new selection. There is one retry policy shared by native and service paths.
• Attention: one run-level reducer/journal query in RunHistory, used by service wait and native historical wait. Transport cancellation and deadlines wrap it; neither reimplements CI classification.
• Faces: service-client holds schemas/verb metadata, service binds implementation, CLI binds forwarding. No server closures leak into the shared verb table.
• No general-purpose “core” or “utils” package. Private worker protocol stays in execution. Service-private request storage stays in service. Helpers move only when an actual boundary requires them.
• Dependency tests: client → implementation imports are forbidden; browser export closures reject Node APIs and server dependencies; execution rejects presentation imports; root-to-package wiring is tested through real entrypoints.

A successful run_wait can report failed CI and exit 0. MCP likewise returns a normal tool result for CI red; only a declared refusal is a tool error. Remove v0.1’s bespoke exit-10 deadline scheme. The skill branches on typed outcomes.

• Persist ordered actionable events and read state at a consistent journal position. Framework reconnect alone does not recover events lost during disconnect.
• Cursor consumption suppresses repeated delivery, not unresolved failure. New attempts and late failures have new event identity.
• Return only included events before advancing the cursor. Bounded pages expose total counts and has_more.
• A settled run always returns its terminal verdict. Do not spin on a known terminal response.
• Wrong-run or expired cursors produce typed refusal and a resync route. Link loss is not coordinator death.
• A completion notification depends on the agent host. Use a finite blocking wait; do not substitute polling just because the transport is HTTP.

Reuse the current log-finalization barrier. Publish red with the completed log, or explicit truncation if the producer is lost. Never infer “flake” from missing diagnostics. Sharded failures retain slice, attempt, placement, and logical recipe. logTails is a bounded live resource; log.read pages durable bytes. Composite keys use framework encoding, never guessed filenames.

• Request ID deduplicates mutations. Retry receipt identifies effective run, attempts, selected roots, reset dependants, scope, SHA, and cursor. A stale expected attempt refuses.
• Choose live vs finalized retry atomically against settlement. A dropped transport means reconcile receipt, not blindly repeat a mutation.
• Shards preserve recorded partition identity and validate dependencies. Unavailable inputs require explicit broader recovery; no silent current-HEAD substitution.
• A passing selection is not a full-pipeline pass. GitHub reporting debt remains separate from test outcome.
• Completion releases leases. Durable recovery avoids keeping an idle fleet alive only to preserve rerun.

• The skill launches nix run github:juspay/odu, with no consumer-project pin. Record the actual daemon/coordinator build and tested source SHA on each run.
• Reuse a compatible daemon; build mismatch reports the active revision. Do not auto-recycle active CI. Explicit upgrade uses framework capture/drain/reattach, restoring the registry and leaving independently owned runs alive.
• The checked survivableSpawnDriver already uses systemd-run --user when launched under a systemd service, and detached spawn otherwise. Configure its environment and absolute binary correctly; test the actual host branches.
• Reboot and unavailable workers remain real failure/recovery cases. A lost observer is not a lost run; lost process ownership is not a clean settlement.
• Share one runtime/handler authority across control socket and browser/MCP transport. Compose control and service surfaces as framework siblings; do not add a competing identity protocol.

odu surface list
odu surface keys runs --json
# get/watch input grammar is generated from the declared key schema.
# Help shows exact composite-key inputs; agents do not construct URI paths.

MCP resources and CLI readers expose the same run-addressed data. Browser reads use Surface hooks. The current cwd-bound MCP resource limitation disappears with service-level run keys.

• Every exposed command, tool, resource and control works end-to-end in that PR, with packaging, help/skill changes, migration and tests included.
• No public flags that parse but fail as “coming later”; no startup service with a placeholder board; no browser retry button waiting on a later engine change.
• No CLI or MCP implementation shipped after an already-advertised “one service, every client” release. PR 2 includes browser + generated CLI + HTTP MCP + stdio bridge together.
• PR 1 is released as durable per-run execution/history. It neither advertises nor exposes the future web service. It remains a complete improvement if PR 2 never ships.
• PR 2 builds on merged PR 1, not an unmerged companion branch or consumer pin. There are no runtime “PR 2 required” paths in PR 1.
• A framework extension, if genuinely needed, is a separate architectural decision requiring its own complete working consumer. It is not assumed as a deferred prerequisite in these PRs.

Framework APIs checked at the Kolu revision currently recorded by this Odu checkout: f3ba6394b4ac667906190f2e5cda3b38ea871e47. This is an audit reference, not a proposed pin in the agent skill.

• Surface: Effect RPC contract
• surface-app: HTTP shell, WebSocket and lifecycle
• surface-mcp: shared verbs and injected transport
• surface-cli: endpoint seam, projection and exit codes
• surface-daemon: singleton gate and control fragment
• supervisor: survivable spawn implementation

Current Odu’s coordinator/run-client boundary remains the execution foundation. Selected session evidence from the earlier review motivates early attention, durable diagnostics and scoped recovery. It does not establish a population latency ranking.