Named protocols

What a protocol is

A protocol is a small standalone script the runner launches only after the password check passes. The scripts are launched detached, so they survive the runner being killed, which matters for the stop and restart protocols.

Eight of them are authored. Three are routed: goodnight stops the voice edge, phoenix restarts it, and ragnarok restarts the laptop. Because those act on the owner's machine and not on the brain host, they carry a PC_LINK command and may only leave that way; the synchronous launcher refuses them outright, so laptop-era logic can never be aimed at the server.

The other five are brain-side: a memory backup, a phone push test, a diagnostics report, an audit archive and a checkpoint of non-secret context. The reports those write are delivered to the owner, because a verdict he never sees is not an answer.

The maintenance family

The other sixty-six are probes, and a probe asks a question about the machine rather than acting on it. They read files, ask the package registry for the newest release, check a socket, and report.

The family covers update checks for every council seat, fleet agent versions, toolchain drift, health and reachability, integrity, configuration hygiene, the owner's machine and the protocol desk's own health. The counts are deliberate: sixty-six plus the eight that shipped makes seventy-four.

The probes are data, and the logic that acts on them lives in one runner, because sixty-six copies of read-a-file-and-print-a-line would be sixty-six places to get the same three things subtly wrong: how a missing target is reported, how a secret is kept out of the output, and what happens when the check raises.

The gate

Every protocol, of both families, goes through the same challenge. The compare is constant-time, a wrong password accumulates a delay that doubles per failure up to a cap, and an optional TOTP second factor is supported. A correct password always works, including during a lockout, because the names are spoken aloud and a lockout would otherwise be a denial-of-service gift to anyone with a microphone.

The protocol is resolved by name, by index or by codename through one resolver, and the same resolution the async path uses. An unset password makes the protocol unavailable rather than universally known.

The drill and the audit line

A drill runs the full authorisation path and checks that the script is present, without launching anything. That is how the recovery protocols stay honest: each one is proven invocable and correctly gated on demand and in tests, without restarting the machine to find out.

An accepted protocol writes an audit line, and a refused one is recorded as a refusal with its reason. The probe runner returns four states: fine, a warning where something exists but is wrong, skipped where there was nothing to check, and an error where the check raised. Skipped is the honest answer, because a probe that cannot find its target must never report that everything is fine.

Read-only by default

Read-only is the default rather than a promise. The runner passes a dry-run flag to every handler, so a probe that one day needs to mutate has to be written to honour it. Secrets are never printed, only named: a probe that inspects a configuration reports the key name and whether a value is set, and the rule is enforced by construction because no handler is given a way to reach a value.

A protocol name does not prove the devices or accounts it depends on are available. Protocol authentication is distinct from a HUD read token, and neither replaces the interlock.