1

Client posts to gateway

POST /v1/execute with a typed ExecutionRequest.
2

Gateway authorises

Auth adapter verifies the client; the gateway materialises a candidate grant and writes it to the audit chain.
3

Scheduler picks a roost

Picks the first roost that satisfies the grant’s driver + isolation-class + capability requirements.
4

Roost spawns the agent

Pulls the driver implementation, applies the isolation class, spawns the CLI with the grant’s args.
5

Output streams back

OutputEvents flow over SSE: gateway → client. The roost journals every event for replay.
6

Exit + rotate

On exit the roost reports the final code; the gateway closes the grant and appends a sealing row to the audit chain.