The same conversation, on a cell or a device
A conversation with the platform happens in one of three places: a workspace, a clean room, or on an Edge Agent that may never have had a network.
The claim worth making is not that all three exist. It is that they are one contract held by two runtimes, and that the parity is pinned by tests rather than asserted. This page is what is identical, what differs, and what a disconnected device refuses to pretend.
What is identical, and pinned
Four things are held to byte-level or verdict-level parity across the cell and the device, each by a cross-runtime fixture rather than by careful implementation.
| Held identical | How it is pinned |
|---|---|
| The tool-call decision | The four-layer permission gate is a semantics-identical mirror on both sides. A subagent on a disconnected device must reach the exact same verdict the cell would, so the trail reconciles on reconnect |
| Prompt-injection verdicts | A shared corpus parity test, so a payload classified as an injection on one runtime is classified the same on the other |
| The reasoning transcript | One canonical transcript contract, with a parity test whose failure message is literally that the edge shape diverged from the core's canonical wire shape |
| The effort vocabulary | The device's --effort levels speak the same vocabulary as the workspace assistant's fast, balanced and deep, and resolve to the same completion token budgets |
That third one has a consequence worth stating: an air-gapped device produces the identical artifact a cell would. The signed reasoning trail renders as the same run, subagents and turns shape the core observability console consumes, so a device's record is not a second-class format someone has to convert.
The four-layer permission gate
Since this is the mechanism carrying most of the parity, it is worth naming in full. A tool call is allowed only if it passes all four layers, top to bottom.
Figure: the four layers in order. Only layer 3 concerns prompting a human; every other layer concerns possibility. Classification sits deliberately above the mode layer, so no autonomy setting can widen it.
Table equivalent
| Layer | What it decides | Can a permissive mode widen it? |
|---|---|---|
| 1. Credential scope | Is the tool in the grant's allowed set? Cryptographic | No |
| 1.5. Classification and clearance | No read up. A tool labelled with a rung or needing a compartment is gated against the agent's clearance | No. It sits above the mode layer on purpose |
| 2. Deployment and organization policy | Which modes and tools this deployment permits at all | No |
| 3. Permission mode | Whether a human is prompted before a consequential action within the ceiling | It is this layer |
| 4. Posture | Untrusted or tainted content drops network-class tools regardless of mode | No |
The differentiator, said precisely
"Bypass" removes layer-3 prompts only.
A subagent running in the most permissive autonomy mode still cannot call an ungranted tool, reach a non-allowlisted host, or run a network tool while it is handling untrusted content. Autonomy buys you fewer interruptions. It does not buy you more reach.
The gate's own header once claimed "semantics-identical mirror" while the device evaluated the layers in the wrong order and had no classification verdict at all. A tool labelled secret, called by an agent whose clearance did not dominate it, was refused on a cell and allowed on a device.
That is the exact failure mode two-runtime parity exists to prevent, and it survived because the claim was in a comment rather than in a test. It is fixed and the ordering is now pinned. The lesson generalises, and this documentation tries to honour it: a parity claim that is not a fixture is a hope.
What differs, and it is only two things
| Aspect | On a cell | On a device |
|---|---|---|
| Where the model runs | An in-process local runtime behind the signed-manifest admission gate, or a third-party provider only if the tier is Full | An on-device sovereign runtime. In tactical and air-gapped profiles a frontier provider is unreachable by construction |
| How far a request may travel | Cost-and-placement routing across a tier ladder | A cheap local tier answers first, and escalation is confidence-gated |
Everything else, identity, clearance, the gate, the audit chain, the transcript shape, is the same.
The degrade direction is one-way
A device can be told to relay its reasoning to the fabric when connected, and it degrades to local if the fabric is unreachable. The reverse never happens: a local answer is not silently upgraded by reaching out.
And the leaf never calls the frontier itself. It emits a partial flagged for escalation and a conductor decides, which is what preserves data gravity: the decision to move a question closer to a bigger model is made by something with a view of policy, not by the device holding the data.
What a disconnected device refuses
The honest half. A device operating dark does not fake the cell's half of the conversation.
- Calls that need the cell's answer inside the same call, certificate refresh, delegation rotation, revocation checks, minting authority, refuse rather than returning a synthetic success.
- It mints no authority and raises no clearance. A subagent chain roots only on a delegation signed by the fleet.
- Under adversarial disconnection a federated answer comes back inconclusive rather than guessed.
- Where a real embedding model is not loaded, on-device recall degrades to keyword rather than ranking by a hollow similarity score.
- With no certificate present, chain verification says origin not checked rather than letting an unverifiable chain read as verified.
The three surfaces, concretely
| Surface | What you get |
|---|---|
| A workspace | The assistant over that workspace's data, members and grants, as a chat principal that cannot see what the asker cannot see |
| A clean room | The room's assistant, one of four always-on tabs, bound by the room's aliasing and egress gate |
| A device | A conversational session or a single-shot goal, reasoning locally, with a durable approval queue for consequential calls and a signed trail you can export and verify offline |
On the device, human-in-the-loop is not a prompt on a terminal someone has to be watching. Paused consequential calls land in a hash-chained, device-signed approval queue that survives a restart, and are resolved deliberately. That is what makes an unattended device governable rather than merely autonomous.
Related
- Chat, the conversational surface and its scoping.
- Prove-It, signed verification bundles over an answer.
- Core and edge, the two-runtime discipline in general.
- Models and sovereign AI, the tiers and the confidence-gated cascade.
- Operate a device air-gapped, the runnable walkthrough.