A roost is the per-host process that accepts dispatches from the gateway and runs the agent’s CLI under a configured isolation class. You run one roost per machine; the gateway sees each as a node.

​
Lifecycle

1

Enroll

The roost boots, generates an Ed25519 keypair, and posts a join token to the gateway’s /v1/enroll. The gateway signs an enrollment receipt that encodes role + capabilities + isolation classes.
2

Heartbeat

The roost reports liveness over the configured transport.
3

Dispatch

The gateway picks the roost, hands it a signed grant, and the roost spawns the agent under the requested isolation class.
4

Stream

Output streams back over SSE; the roost journals the run; on exit, the grant is rotated.

​
Isolation

Process / Jail / MicroVM. The roost picks the strongest the host supports and fails closed if the floor isn’t met. See isolation classes.