The boundary is enforced in code rather than promised in prose. Where a piece is narrower than the idea, the narrowing is stated here and a test holds it there.
Work items
Live, public API A unit of work with a brief, provenance, dependencies, acceptance criteria, decisions, an owner and its own event history — durable, and driven by one command document shared by REST, the CLI and in-process callers.
modules/sessions/work_model.go · modules/sessions/work_api.go
Leases
Live, public API Ownership as a fenced, expiring authority: acquire, renew, release, take over, revoke. A stale holder cannot keep acting on a work item, and concurrent acquisition yields exactly one winner.
modules/sessions/work_lease.go
Messages, acknowledgements and handoffs
Live, deliberately scoped Durable conversation bound to a work item, with replay and stale-epoch rejection. The acknowledgement is the part worth pausing on: coordination breaks far more often because a message was seen and not acted on than because it was never delivered, and "read" and "answered" stop being the same word.
Real WITHIN an orchestration workflow. The general, cross-everything inbox is deliberately not wired, and that is enforced rather than promised: a boot test pins the authority sources boot binds, and their order, and fails on any of the four known preparatory activations. It is not an exhaustive allowlist — a future path with a different selector would need its own case — but wiring any of the wired-up ones by accident is a red test, not a surprise in production.
modules/sessions/communication_model.go (the shapes) · communication_ack_service.go and communication_ack_apply.go (the acknowledgement path and its epoch checks) · cmd/olivares/communicationauthorityboot_test.go (the boot test that keeps the public plane unwired)
Launch for work
Live, deliberately scoped Reserve, take the lease, and only THEN spawn the session — persisting work, epoch, fence and execution so a retry is safe rather than a second run.
Through orchestration, not as a free-standing entry point.
modules/sessions/runtime_work_launch.go
Remote execution over A2A
Live, deliberately scoped · Business · Identity & Scale Plan, test, start, observe and cancel work on an authorized peer, with durable receipts for what was delegated and what came back.
Mounted ONLY when a destination is configured. With no authorized target the seam is not mounted at all — there is no path that dispatches work to an arbitrary peer because a configuration file asked nicely.
cmd/olivares/wire.go · cmd/olivares/orchremote.go
Shadow mode and final work authority
Not built Dual-report against the system you already run, with a comparator, before this plane becomes the one that decides.
NOT "coming soon" and not "partial": absent. A deployment cannot today hand the work plane the last word over a session, and nothing in the product should be read as offering that. When it exists it will arrive with the evidence that it works — a comparison window against the existing sources, not a version bump.
design only