Placing work across Edge Agents

This is the operator's view of the digital nervous system's outward-facing planes: how a cell (the brain) places work on Edge Agents (the tentacles), how you make an agent eligible for work and steer placement, and what happens when peers must coordinate, including when the brain is unreachable. It assumes a device is already enrolled and healthy.

What you can and cannot control

Placement itself is automatic and deny-closed. You do not assign steps to devices by hand. What you do control is eligibility (is this agent reporting headroom, and is it in scope?) and admission (is it allowed work right now?). This page is organized around those levers. Ceiling: fan-out is intra-node and behind a platform flag; cross-node placement is not built.

The placement decision, end to end

Figure: the placement decision. Every cyan gate must pass for an agent to be selectable; the cell then ranks the survivors freest first, re-checks admission on a fresh read (green) to close the window between ranking and dispatch, and enqueues the step. If no agent is selectable, or the chosen one just flipped to a hold, the cell places nothing (red); it never falls back to a loaded or held agent.

Table equivalent

Gate	Passes when	If it fails
In scope	The agent is bound to the step's workspace or clean room	Agent is out of scope, not selectable
Admits work	The device status is active	Not selectable (see lifecycle holds)
Reporting headroom	Connected, capacity zone not full (not warning/debt), positive headroom	Not selectable
Rank	Applies to every remaining candidate	Freest agent wins; ties broken by most headroom
Fresh re-check	Still admits work at dispatch time	Place nothing: no fallback

Make an agent eligible for work

An agent that reports no headroom is treated as having none to offer, "headroom is never invented." Three things make an agent a real candidate:

1. It is connected and heartbeating. A device reaps to offline/stale when it stops checking in. Confirm liveness with s9 status on the device, and that its heartbeats are reaching a cell.
2. It reports a capacity zone. Capacity reporting is opt-in: an agent surfaces headroom only when its operator has configured a concurrent-step ceiling. Without that ceiling, the agent heartbeats but offers no headroom, so it is never selected. Set the ceiling in the daemon's gateway configuration so the runtime has a denominator to report against.
3. It is in scope. Placement is workspace/clean-room-scoped: an agent must be bound to the workspace or clean room the workload belongs to. An unbound or differently-bound agent is out of scope and cannot be chosen. This is how the work boundary is honored at the edge.

Steer placement with lifecycle holds

You do not pick the device, but you can take a device out of the running (or put it back) with the four lifecycle holds. They are issued from the cell and carried to the device on its configuration lane; the status change and the admission gate bite immediately at the cell, and the device honors the hold on its next poll (so an offline device still respects it on reconnect).

Hold	Effect	Use it to
Pause	Stops new work; device keeps heartbeating	Take an agent out of placement without losing sight of it
Resume	Returns the device to active	Put a paused/drained agent back in the running
Drain	Stops new work; lets in-flight work finish	Retire or update an agent gracefully
Quarantine	Isolates the device; requires re-attestation to return	Contain a suspect device during an incident

Because the admission gate (active only) is consulted at every work surface the gateway, the query paths, the workflow poll lane, and again at placement, a held device cannot be handed work through one door that another door refused.

Spread a batch across several agents (intra-node fan-out)

When one workflow node has many independent units, a cell can fan out, spread the units across several distinct, freest, in-scope agents, re-reading capacity per unit so a filling agent stops receiving more.

Fan-out is intra-node and flag-gated

Fan-out spreads work only within a node (a tentacle's default reach), ships behind a default-off platform flag, and today gathers results with a simple per-unit collect (a full hierarchical reduce is owed). Cross-node fan-out is not built. Treat fan-out as a bounded intra-node primitive, not an estate-wide scheduler, and enable it deliberately rather than assuming it is on.

Coordinate agent-to-agent (A2A)

Edge Agents can talk to each other directly. An agent publishes a signed agent card (a canonicalized identity document with a detached signature) and a peer verifies and pins that card before exchanging tasks over a standard JSON-RPC method.

Accepting inbound tasks is opt-in. By default an agent runs no inbound server and will not act as a delegate; an operator must enable the inbound role, and even then the agent refuses to delegate under a tainted or untrusted execution posture. Enable inbound A2A only on agents you intend to be delegation targets, and keep it off on sensors and pure consumers.

Run without the brain: the edge conductor

If a cell (the brain) becomes unreachable on every transport, the mesh does not stall, the most-capable reachable Edge Agent takes a leased conductor role and coordinates the others locally. There is nothing to configure; the behavior is automatic and fail-closed:

• An agent declines the conductor role unless it has positive evidence the brain is dark, so a flaky link does not spawn a rival conductor.
• "Most-capable" scores model tier × reachable transports × headroom, so a stressed agent (warning or debt zone) cannot win the role.
• The lease auto-fails over to the next-best peer if the conductor dies, and a conductor that becomes overloaded sheds the role by not renewing.
• Decisions use a deterministic, rule-based decomposition plus a small local model (never a frontier model) and the local reduce returns inconclusive rather than a falsely-confident answer a coerced peer could swing.

When the brain returns, the conductor sheds and the estate is brain-led again.

Conductor status

The conductor election, scoring, decomposition, and reduce logic are built and unit-tested. The role is leased through the fabric, so a conductor that goes dark or is wound down sheds it rather than stranding the work, and reachability is a per-peer attested map: each peer's reachability is an Ed25519-signed observation, admitted only when it verifies against that peer's member identity and is still fresh, so a member with no fresh attestation is not a contender at all. The connected intra-node fan-out and this disconnected conductor are two mirrors of one model: the brain hands the concept off to the edge when dark; it does not run two schedulers.

Across the deployment matrix

Corner	How placement and coordination behave
Single-cell	The cell places work on its node's agents; no peer cell, so no A2A across cells
Multi-cell (same node)	Presence and capacity converge across the node's cells; placement and fan-out are intra-node
Sovereign / air-gapped	If the brain is dark, the edge conductor runs the local reflex; work spools and drains by store-and-forward
Cloud-enabled	The same gates and ranking apply over managed transport

Related topics

• The digital nervous system, the concept and the four planes this how-to operates.
• Edge operator runbook, the day-two s9 commands for keeping an agent healthy and heartbeating.
• The two work boundaries, the workspace/clean-room scope placement honors.
• Core and edge, the brain/tentacle split and the parity discipline behind it.