The ming-qiao awakener

A secure, model-agnostic acceleration layer that turns a durable inbox event into a verified physical wake, completed cognition, explicit acknowledgement, and safe return to quiescence.

The inbox is the source of truth. Wake is a short-lived, authenticated hint — not message delivery itself.

Two planes, one durable truth

The message plane preserves intent, authorization, ordering and acknowledgements. The wake plane minimizes latency while remaining disposable and replay-resistant.

Where it stands
Current pilot	Partial
Physical wake	Not yet proven E2E
Default posture	Roster absent / deny
Live transitions	Explicitly gated

What each component is answerable for

The contracts the drawing carries, one per component.

Client. Uses MCP, HTTP or an SDK to write a typed message. It is authenticated, but authentication alone never grants Tier-0 authority.

Admission. Single policy path for every transport. Resolves principal, schema, target and narrow control roster; absence or malformed configuration denies by default.

Durable inbox. Canonical message truth: thread, recipient, message ID, read state and outstanding Tier-0 witness. A wake may disappear; this state must not.

Tier router. Maps schemas to reliability tiers. Only InterruptAlert / Tier-0 Voice fires the physical wake side channel.

Audit chain. Records admission and refusal with correlation IDs and content hashes. It supports drift detection; historical chain position must not be mistaken for unique ordering after concurrency.

Tier streams. Durable, priority-aware message delivery. Their contract differs from the ephemeral wake side channel.

Signed wake hint. Short-lived Ed25519 envelope with target, nonce, monotonic per-target freshness, issue time and expiry. It carries no message content.

Wake daemon. Verifies the signal, classifies stale/replay/tamper, applies cooldown, resolves runtime capabilities and dispatches without claiming cognition succeeded.

Wake receipt ledger · proposed. One correlated lifecycle for emitted, accepted, dispatched, read, completed and acknowledged states. This eliminates inference across unrelated logs.

Portable broker · proposed. Extract publish/subscribe contracts so NATS remains the reference adapter rather than a permanent protocol dependency.

Runtime adapter. Translates an accepted hint to AgentAPI, cmux, webhook, desktop notification or local runner. Capabilities must be declared, never guessed.

am-dyad station. Reads durable work, establishes a known inbox tail, applies local runaway brakes, invokes the model, records results and exposes loopback-only status.

Model runtime. Produces a typed finish reason. Only Complete satisfies pilot observation; receipt or truncated output is insufficient.

Tier-0 ACK · validating contract. Authenticated acknowledgement for the exact alert ID. Until recorded, the alert remains outstanding and pins cursor horizon advancement.

Operator gate. Controls temporary roster installation, deployment, activation, latch clearing, abort and cleanup. Local development authority does not imply these transitions.

The invariants

Delivery. A lost wake hint may increase latency; it must never lose the durable inbox message.

Authority. Only an authenticated, roster-authorized Tier-0 schema may cause a physical wake.

Identity. The control principal, inbox recipient, bus identity and runtime station must be distinguishable and auditable.

Observation. Received is not observed. Only a completed model turn satisfies the pilot; truncation, timeout and errors do not.

Acknowledgement. A Tier-0 alert pins cursor advancement until an explicit authenticated ACK records the outcome.

Fail-closed. Bad configuration, replay, tamper, runaway activity or an uncleared latch must stop or refuse work — not silently widen authority.

One alert, from intent to safe quiescence

Authorized sender. Submits a typed control message through MCP, HTTP or an SDK. The payload names one target and carries a stable message ID, schema, priority, intent and response expectation.

ming-qiao admission. Authenticates the caller, resolves the control roster, validates schema and target, and defaults to refusal when configuration is absent, malformed or unauthorized.

Durable message plane. Persists the message, thread relation and recipient state before wake acceleration is relied on. Appends an admission/refusal record with content hash and correlation identifiers.

Tier router. Maps InterruptAlert to Tier-0 Voice. Other schemas remain durable but do not fire the physical wake side channel.

Wake emitter. Mints a short-lived Ed25519-signed signal containing target, router principal, random nonce, per-target monotonic freshness token, issue time and thirty-second-or-less expiry.

Wake daemon. Rejects malformed, stale, replayed or tampered signals; applies a small per-target cooldown; resolves the runtime from a capability manifest; dispatches through AgentAPI, terminal multiplexer, webhook or another adapter.

Agent station. Starts or receives the hint, then reads the durable inbox. It establishes a clean and known inbox tail so the test event cannot be confused with pre-existing backlog.

Local safety fuse. Before cognition, checks durable latch, count backstop, loop shape and echo repetition. After cognition, publishes the same count used by enforcement to logs and loopback status.

Model harness. Processes the exact directive, records input fingerprint and finish reason, and rejects truncated, timed-out, budget-exceeded or errored turns as pilot observation.

Reply and resync. Writes the response or explicit silence to the canonical thread and correlates it to the input message. Prose acknowledgement alone is not a control-plane ACK.

Tier-0 ACK. The authenticated target records a signed outcome for the exact alert ID. This clears the outstanding witness and allows inbox cursor advancement.

Cleanup. Confirms receipt, audit linkage, station state and counts; removes the temporary roster; restores default-denied posture; preserves incident evidence; and stops the station if the test or safety gate requires it.

Operational states

DARK → ARMED → WAKING → READING → COGNIZING → ACKING → SYNCED

ANY ACTIVE STATE → replay / auth / ceiling / audit failure → REFUSED OR LATCHED DOWN

• DARK — no station process; durable inbox still accumulates.
• ARMED — station is eligible, status surface is visible, roster may still be empty.
• WAKING — hint accepted; no claim yet that the agent read the message.
• SYNCED — completed cognition, durable response or silence, Tier-0 ACK, cursor movable.
• LATCHED DOWN — refuses boot until an authorized operator clears the live latch; the durable incident record survives.

What failure is allowed to do

Failure	Required behavior
Wake hint lost	Inbox polling eventually delivers; latency rises, data does not disappear.
Wake stale	Reject as operational anomaly; never dispatch.
Nonce replay / freshness regression	Reject and audit as replay attempt.
Bad signature / wrong router	Reject and classify as tamper/auth failure.
Unknown runtime / unavailable adapter	Log a typed skip/failure; preserve inbox work; do not claim wake success.
Backlog at target	Do not measure wake latency until a known tail is established.
Output truncated	May remain a queue-level handled turn, but cannot satisfy end-to-end observation.
Runaway / repeated directive	Audit the trip, fsync the latch, exit non-zero and refuse restart until cleared.
Audit write failure during trip	Still write the latch and stop. Safety takes precedence; loudly report missing provenance.

What exists, what is being proven, what remains gated

Capability	Status	Evidence / remaining work
Common HTTP + MCP admission logic	Implemented	Typed schema mapping, default-deny policy, content-hashed admission/refusal audit.
Tier-0 wake side channel	Implemented	Core NATS subject, signed signal, 30s TTL, nonce window, per-target freshness verification.
Runtime dispatch	Implemented	AgentAPI and terminal-multiplexer paths; capability manifest controls eligible stations.
Durable inbox + Tier-0 cursor barrier	Implemented	Unacknowledged Tier-0 delivery blocks cursor horizon advancement.
Local dyad runaway fuse	Implemented	Count backstop, loop-shape and echo detectors, durable latch, boot refusal, loopback status.
Post-invocation ceiling observability	Validating	Mutation exposed missing log and status discriminators; corrections and full matrix rerun are in progress.
Durable latch-trip provenance	Validating	Latch-clear survival is proven. Ordering test was vacuous; self-witnessing audit field added for verification.
Model budget / completion gate	Validating	Explicit model-window mapping and Complete-only pilot predicate; both acceptance directions mutation-tested.
Backlog-aware activation packet	In progress	Must define known-tail setup, exact test ID, Tier-0 ACK ownership and order, abort and cleanup.
Full physical wake proof	Not yet authorized	Prior pilot proved admission, delivery, observation and resync but targeted a polling console with no wake process.

Current finding. A successfully delivered Tier-0 alert pins the target’s inbox cursor until an explicit control-plane ACK. The acknowledgement is part of the wake contract, not optional cleanup.

Evidence before activation

• Pure-unit tests — schema routing, signature verification, TTL, replay windows, thresholds, finish-reason discrimination.
• Compile-valid mutations — every claimed discriminator must turn red on a compiling broken implementation.
• Component integration — admission to persistence to tier routing to wake publish; daemon verification to adapter dispatch; dyad status to audit to latch.
• Crash and ordering tests — inject failure between audit and latch, across restart, and while clearing live state.
• Broker tests — reconnect, duplicate delivery, out-of-order signals, stale keys and multiple targets.
• End-to-end pilot — dormant eligible station, known empty tail, one authorized alert, measurable physical wake, completed cognition, signed ACK, cleanup.
• Adversarial suite — unauthorized sender, malformed roster, wrong target, bad signature, nonce replay, freshness regression, backlog ambiguity, output truncation and runaway echo.

Definition of full test ready

• Clean exact candidate revision; no hidden or uncommitted code.
• Mutation matrix all discriminating and compile-valid.
• Relevant unit, integration and all-target suites green with direct exit codes.
• Independent reviewer reproduces evidence from the exact revision.
• Activation packet names every precondition, owner, exact ID and rollback.
• Narrow roster is reviewed, temporary and default-deny on absence or malformed input.
• Target inbox tail is known and outstanding Tier-0 state is intentional.
• Runtime adapter and model budget are proven for the selected target.
• Explicit authority granted for binary or config change, activation and live wake.

Trust boundaries and mitigations

Privilege escalation. Typed schemas, authenticated principal, narrow roster, common admission code, default deny, separate control and runtime identities.

Replay and spoofing. Ed25519 router signature, random nonce, at least 1024 entries of nonce history, per-target monotonic freshness, short expiry.

Wake storms. Per-target cooldown plus local count, loop-shape and echo fuses. Ceilings are limits, never throughput targets.

False success. Separate persisted, wake-accepted, dispatched, read, completed, replied and acknowledged states. Never collapse these into delivered.

Secret leakage. Wake hints carry identifiers, not message content or credentials. Runtime adapters resolve secrets locally with least privilege.

Forensic loss. Audit before live latch, self-witness ordering, durable append and fsync, signed ACK, incident evidence survives remediation.

Future versions: preserve the contract, replace the machinery

v0.9 · Harden pilot — now. Close all mutation gaps; backlog-aware packet; Tier-0 ACK lifecycle; one narrow physical-wake proof; repeatable abort and cleanup.

v1.0 · Portable core — next. RuntimeAdapter trait; capability registry; secret-free pending marker; Linux systemd and macOS launchd; reference AgentAPI adapter.

v1.1 · Receipts — proposed. Durable wake receipt ledger; accepted, dispatched, observed and acked timestamps; stable correlation ID; idempotent ACK API and MCP tool; OpenTelemetry spans.

v2 · HA and federation — proposed. Persist freshness state; leader-elected emitters; key rotation with overlap; multi-broker adapter; cross-host runtime endpoints.

v3 · Policy-driven autonomy — research. Capability-scoped wake grants; budget-aware scheduling; adaptive cooldown with hard ceilings; formal state-machine model; conformance test kit.

Modules worth stabilizing

Module	Public contract
awakener-core	Wake envelope, signing and verifying, decision taxonomy, state machine.
awakener-admission	Schema-to-tier mapping, roster policy interface, refusal reasons.
awakener-broker	Publish/subscribe traits; NATS reference adapter.
awakener-runtime	Capability manifest and adapter result types; AgentAPI, webhook and terminal implementations.
awakener-station	Known-tail reader, local fuse, observation and acknowledgement orchestration.
awakener-audit	Append-only event schema, receipt ledger, correlation queries.
awakener-conformance	Mutation fixtures, adversarial broker, fake runtimes and end-to-end acceptance suite.

Directions I would take

• Make wake receipts first-class in v1.1. The current architecture can prove pieces, but operators need one correlated lifecycle without inferring across logs.
• Keep broker and runtime adapters replaceable. NATS and AgentAPI are good implementations, not the protocol itself.
• Persist replay and freshness state before high availability. In-memory monotonic state is appropriate for one emitter; it becomes unsafe when emitters replicate.
• Treat ACK as an agent capability. A runtime that cannot acknowledge Tier-0 safely should not be eligible for unattended Tier-0 wake.
• Standardize events before dashboards. Use stable versioned JSON events and OpenTelemetry-compatible correlation, then build UI projections.
• Never auto-tune away hard brakes. Adaptive scheduling may reduce noise, but signed authority, absolute ceilings and default deny should remain non-negotiable.
• Offer a local single-node reference stack. One command should start a broker, a ming-qiao-compatible server, a fake model station, a verifier and the conformance suite without cloud credentials.
• Add a formal model. A small TLA+ or PlusCal state-machine specification would pay for itself around replay, ACK barriers, restarts and concurrent emitters.

Normative rules

The words MUST, MUST NOT, SHOULD and MAY are intended in the RFC sense.

Message and wake

• A message MUST be durably persisted before a wake is treated as meaningful.
• A wake MUST contain no message body or secret.
• Only a roster-authorized Tier-0 schema MAY emit a physical wake.
• Every wake MUST be signed, short-lived, target-bound and replay-resistant.
• A dropped wake MUST degrade to polling, never message loss.

Station and acknowledgement

• A station MUST read the durable inbox after waking; the hint is insufficient.
• A test MUST establish a known target tail before measuring latency.
• Only a complete cognition MAY satisfy observation.
• An outstanding Tier-0 alert MUST pin cursor advancement until authenticated ACK.
• Clearing live state MUST NOT destroy the only durable incident evidence.

Versioned, secret-free wake signal

{
	"specversion": "1.0",
	"type": "org.ming-qiao.agent.wake.requested.v1",
	"id": "019f...uuidv7",
	"source": "urn:ming-qiao:router:public-key-fingerprint",
	"subject": "agent/mataya-dyad",
	"time": "2026-08-17T12:00:00Z",
	"datacontenttype": "application/json",
	"data": {
		"message_id": "019f...uuidv7",
		"target": "mataya-dyad",
		"nonce": "base64url-128-bit-random",
		"freshness_token": 42,
		"expires_at": "2026-08-17T12:00:30Z",
		"router_key_id": "sha256:...",
		"signature": "ed25519:..."
	}
}

CloudEvents-compatible fields are recommended for portability; the signed canonical body should exclude transport-added headers and remain deterministic.

Declare, do not infer

[agents.mataya-dyad]
runtime = "agentapi"
endpoint = "http://127.0.0.1:9403/message"
headless = true
tier0_ack = true
max_concurrent_wakes = 1
status_endpoint = "http://127.0.0.1:9503/status"

[agents.desktop-human]
runtime = "desktop-notification"
headless = false
tier0_ack = false
requires_human_submit = true

Never overload delivered

persisted
  → admitted | refused
  → wake_emitted
  → wake_accepted | stale | replay | tamper
  → dispatch_attempted
  → runtime_notified | runtime_unavailable
  → inbox_read
  → cognition_complete | truncated | failed
  → response_recorded | silence_recorded
  → tier0_acknowledged
  → cursor_advanced
  → cleanup_complete

Change protocol

• State the invariant being changed and name the exact failure a broken implementation must exhibit.
• Identify the authoritative source for every count, state and timestamp; avoid parallel observability-only truth.
• Add a known-positive control and a compile-valid mutation that breaks only the claimed property.
• Preserve default-deny behavior and keep new fields additive and versioned.
• Do not equate function existence, log text, process exit zero or message receipt with end-to-end success.
• Record exact revision, clean or dirty state, direct command exit codes, test totals and exclusions.
• Require independent reproduction before live activation.
• Separate local development authorization from push, merge, deployment, roster, activation and live-test authority.
• For any remediation that destroys live evidence, persist a durable, independently verifiable incident record first.
• Update this architecture contract when behavior changes; implementation and documentation must move together.

---

This document intentionally omits deployment-specific paths, credentials and personal identities. Suggested license for the design text: CC BY 4.0; suggested license for reference implementations: Apache-2.0 or MIT. Validate all current claims against the chosen release revision before publishing.