Ch.10: cross-host lead-to-lead already shipped; rename the proposed exchanges
The scope note said only the single-host reply inbox was as-built. That is
wrong: lead-to-lead coordination across hosts works today over a shared AMQP
vhost (coordinator: block, fleet_send{coordId}, LeadMailbox + LeadCoordLoop).
It deliberately does not use the exchange topology in section 3 — it is a
durable mailbox per lead, carrying coordination only, never a task. Said so at
the top and added a short as-built table to section 9, so the chapter cannot be
read as 'none of this is real yet'.
Also renamed the proposed exchanges bridge.* -> fleet.* with the product.
Match the code cutover: daemon name, config (fleetd.yaml), scripts, launchd/
systemd units, module dir, and MCP tool prefix bridge_* -> fleet_*. Kept:
the BRIDGED_MEMBER security marker, mcp__bridge__ (historical mount name), and
the .bridged-worktrees on-disk path. The portable CLAUDE.md block stays
byte-identical with the repo's CLAUDE.md.
Chapter 10: fold in the adversarial review — envelope, dual ack, queue migration
Second-pass (Opus reviewer) findings, accepted and written through:
- §2.1 the message envelope: AMQP-header fields + kinds; sig over exact body
bytes + canonical header subset (no JSON canonicalization in the security
path); verify to == routing key; reject-to-DLX on failure. CB-201's descope
stays right single-host and wrong across hosts — stated.
- §3 footnote corrected: the inbox keying INVERTS (sender-keyed as-built →
recipient-keyed), so CB-308 is a migration, not a rename; .v2 queue names
dodge the PRECONDITION_FAILED crash loop on in-place upgrade.
- §5/§6 rewritten as the dual ack model: reply path at-least-once (ack after
drain), forward path at-most-once (ack BEFORE inject) + INJECTED
confirmation; basicQos so the backlog stays on the queue.
- §7.4: expiry is gateway-enforced (expiresAt), broker TTL a backstop;
NO_WAITER answered on arrival.
- §10.1: caps made real by prefetch; expiry sweeper (head-of-line); DLQ
consumer reports FAILED to the sender; DLQ itself capped.
- §8 checklist: separate confirm/mandatory publish channel (return-before-
confirm caveat), queue deletion on stop, host-level signed heartbeat with
profile list, exclusive-lock takeover caveat.
- §9: keying migration + multi-primary named as CB-500's delta.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_013ZGgxLQ2VpwZhEYoru8rkf
Dai Ha
Dai Ha
kevin