The PM of one repo commissions the PM of another, and the answer comes back (nxf 6j6v.70dy, first slice)

[cabcookie]

What this does

On one machine, a persona of one workspace commissions a persona of another workspace and gets the answer back. Both repos stay what they are: the receiver runs its persona in its own working copy, with its own board and memory, and only the border thread crosses.

alpha/pm:  nxc send --to test/beta/pm "When does the access rule ship?"
           → recorded in alpha's own log, handed over
beta:      access checked (trusted? role listed in addressable.external?) → beta's pm starts
beta/pm:   nxc reply "With version 0.300."
           → handed back, alpha's pm is woken and passes it on to its owner

Tickets: 6j6v.ewbj (first, it is the precondition), 6j6v.q32p, 6j6v.t5xb, 6j6v.4gp2, 6j6v.szc5. Epic 6j6v.70dy. Specification and direction: the coordinator workspace's 2026-10-03-schnitt-1-pm-spricht-mit-pm-design.md and …-standards-und-foederation-richtung.md.

The pieces

ewbj	A session that owes a reply was granted the bare, auto-approved Bash, so tools: [] meant a full shell. It is now Bash(nxc reply:*) for any declared list without Bash. tools absent and tools: [Bash] behave as before. Measured against the pinned SDK 0.3.215: the heredoc and one-line reply forms run; nxc send, writes, gh, curl, chains, pipes, redirections and $(…) are refused. A live smoke shows a tools: [] persona answering and failing to touch a file, and it goes red when the rule is widened.
q32p	Stored workspace name <owner>/<repo> ([workspace] name in .nxs/config.toml), derived from the git origin without the host on first use. nxs name [<owner>/<repo>] prints or sets it. normalize_remote moved to nxs_foundation::workspace_name, so the stream id and the name are one parse. <name>/<persona> is an address.
t5xb	addressable: { external: ["*/pm", "nxsflow/manufakt-io/pm"] } is a new variant Addressable::OnlyWithExternal, added as a variant rather than a field so Only { .. } matches in embedding code don't break. nxs sync trust add --workspace <name> trusts a neighbour's replica key by name. Refusals name their reason: workspace unknown, not on this machine, not trusted, role not admitted, no such persona, depth limit reached.
4gp2	crate::border. The hidden verb nxc handover (Engine::handover) copies only the border thread's ops between the two logs via Store::apply: signatures are verified, and op ids make it idempotent, so there is no echo. Each run acts only in its own workspace. send/reply on a border thread run it at once and then the peer's handover as a child process in the peer's root. The service runs it every 5 s where .nxs/border-open is present. Depth travels in the signed refs.border. Two hours without a sign of life cancel the thread. nxc withdraw takes it back on both sides.
szc5	StatusThread.border {peer, direction, state, reason} with the four A2A states, in both workspaces and on Engine::status. The CLI shows — across the border to test/beta: completed.

Decisions the specification does not make (also noted on the epic)

1. Trust is needed on both sides. The answer arrives as an op signed by the receiver's key, and an untrusted op discharges nothing (the existing pzkb rule). So send refuses up front, with the command to run, when the caller's workspace does not trust the receiver.
2. A person cannot commission from outside. Without a session there is no role to stamp, and the slice excludes it.
3. addressable stays strict (deny_unknown_fields). An older engine fails on external:. This is stated in the personas guide (EN/DE) and in the changelog. No declaration in this repo carries external:.
4. Withdrawing an operation cancels its border threads and wakes nobody. The deadline wakes the commissioner with the reason.
5. In the receiver, the border thread is the root. Its foreign parent is read as no parent (PARENT_WITHIN_THE_BORDER), so the operation does not hang under a phantom. A question asked across the border is not shown as NEEDS DECISION there.

Existing defects this path ran into, fixed here

• Spawned sessions did not inherit NXS_SERVICE_INSTANCE, so a dev build's persona read the production service home.
• A wake on the way back (ChainMove::Unwind) never carried the obligation the woken session still has. A persona without tools: was woken with an answer and then refused its own nxc reply. This applies in-house as much as across the border.
• The CLI timer did not forward schedule_delivery/schedule_resume. The trait default booked a held delivery as a channel tick on a session id ("no such thread"), so on the command line the service never delivered a held answer.
• The sidecar reminded a commissioner whose sub-round answer was already held for it, and then substituted its reply. A held answer now keeps the sub-round in flight (waiting_on_sub_round).

Evidence

Live, two real git repos (test/alpha, test/beta), real sidecar and model, a dev-instance service (2026-10-03):

Run	Result
Scenario, with service	alpha's pm asked beta's pm and told its owner "…ships with version 0.300"
Scenario, without service	Same result. The answer was delivered by the immediate handover in send/reply and needed no service.
Coder	"Refused by test/beta/pm: role not admitted." Nothing started in beta.
Question	beta's pm asked back with --escalate. It woke alpha's pm, which escalated to its owner. Nothing in beta was woken.
Depth	Started at NXC_HOP=28: alpha 29 → beta 30 → alpha 31 → beta 32, then "hop 33 exceeds the cap of 32", and the answers unwound back to the owner.
ewbj	A tools: [] persona answered and could not touch.

Deterministic:

• crates/chat/tests/a_persona_commissions_across_the_border.rs: 16 tests at the engine seam between two real workspaces. They cover every acceptance point of the specification's section 9 except 7 and 9, plus no echo, the deadline, withdrawal, and a held answer.
• crates/nxs/tests/two_workspaces_on_one_machine.rs: the real binary. It covers nxs name, trust by name, the peer's handover as a child process, and status in both directories.
• Lib tests: the address parse, the persona_chat guard, the held-answer rule, and the CLI timer's forwarding.
• Mutation-checked: removing each of the guard, the role check, the trust check, the op filter, the timer forward, the wake obligation, the held-answer wiring, the deadline, the NEEDS-DECISION exclusion and the border parent turns its test red.

Local gates run:

• cargo fmt --check.
• Lean cargo check for chat and nxs.
• The node sidecar suite.
• The changed and directly related test files: 26 chat test binaries plus the lib tests, and the new nxs test.
• Clippy and the full suite are CI's, per project rule.

Not in this PR

• 6j6v.7k58 (one definition for every repo; acceptance point 7) and the manufakt.io desktop app (point 9).
• No fallback when the service is not running. An answer held for a caller that is still in its turn is delivered only by the service, in-house as well as across the border. That is 6j6v.v0pj, which asks the owner whether a fallback is wanted. With the service it works; it is measured above.

🤖 Generated with Claude Code

https://claude.ai/code/session_018Sipejn8YQhKgngxeHpMhT