Worker pool

Every agent is placed on exactly one pool. The shared pool is the platform's; a tenant's own pool is the tenant's; a local pool is one person's computer, enrolled from the Hub. Placement is a fact on the agent, changed in the Hub, and enforced by the platform on every call — never taken from what a worker says about itself.

A pool runs the published runtime image at a pinned release, whichever pool it is. A worker says its version at boot and in every heartbeat; the control plane serves the current release and the one before it, and tells an older worker at boot that it must be updated.

A worker reaches the registry with a credential issued for its pool and nothing else: never the platform's token. The credential names the pool, is stored hashed, is shown once at enrolment, and is revoked from the Hub in one click.

Every resource a pool names is checked against its placement, not only an agent id: the agent, the secret reference, the brain, the tenant, the run — deny by default on every route a pool may call. An agent's secrets are the references the platform issued to that agent and no other's; a tenant's workspace token, another agent's tokens and the platform's routes are never a pool's to read. Anything outside its placement answers as not found, never as forbidden.

Setting an agent to local mode shows one command, in a PowerShell and a bash flavour, that installs the runtime and brings the agent online. Only an owner or admin can mint it. It carries an enrolment token that is a secret while it lives: random, stored hashed, bound to that tenant and pool, good for fifteen minutes and for one exchange, consumed and answered in one step. After the exchange, or after it expires, reuse is refused and the Hub is told of the attempt; a lost answer is recovered by minting a new command, never by reusing the old one.

The installer (tonomanctl) checks for podman and what else it needs before it changes anything, says plainly what is missing and how to get it, and stops there. It installs nothing on a machine that cannot run the agent, installs a pinned release when it can, and keeps the pool's credential and certificate readable by that user alone.

A worker tells the platform it is alive every minute, with its version. The Hub shows a pool online or offline since when, and an agent on an offline pool is shown as not answering rather than as healthy.