0.1.4 is documentation only — nothing to upgrade. PROTOCOL_VERSION is still 2, so a 0.1.0 party and a 0.1.1 party talk to each other in both directions. No dependency, schema, wire field or on-disk shape moved.

This README used to open with a stack of release notes instead of with the package. The history moved to docs/release-notes/ and CHANGELOG.md, where none of it was lost. Full note: docs/release-notes/0.1.1.md.

@byollm/control-plane

0.1.0

The reference control plane: it resolves a person's mapping and authors one signed grant per job, against a policy store it does not own and with a key it never sees.

import { ControlPlane, MemoryPolicyStore, keypairSigner } from "@byollm/control-plane";
import { Relay } from "@byollm/relay";

const engine = new ControlPlane({
  store: new MemoryPolicyStore(),
  signer: keypairSigner(keys),
});

const relay = new Relay({
  fixture,
  controlPlanePublic: engine.publicKey,
  authorGrant: (input) => engine.authorGrant(input),
});

What this is for

A byollm device runs nothing on somebody else's behalf without a grant: a short-lived, single-use, signed statement that this job, for this person, on this device, may run — and which of the owner's services should answer. The device verifies it against a key it pinned when it paired, so the party routing the job can withhold a grant and cannot forge one.

This package is what writes them.

Two things it deliberately does not hold

Your data. Accounts, consents, memberships and mappings live behind PolicyStore. This package reads; it never owns. That is the split that lets a hosted product keep its database while the rule over that database stays readable — because a rule nobody can read is a rule nobody can check.

Your key. GrantSigner is a function, not a keypair, so custody can sit behind a KMS and this code cannot tell.

The contract

@byollm/control-plane/store-contract is a suite any PolicyStore can run against itself:

import { describePolicyStoreContract } from "@byollm/control-plane/store-contract";

describePolicyStoreContract("my store", { make: async () => ({ /* … */ }) });

It ships in the package because the implementation that matters most is in somebody else's repository, and a contract only its author can run is a description.

The law it applies

In order, and the order is by whose fact each step is:

1. A device always runs its own owner's work, and no store is asked. It is a law rather than an optimisation — routing it through a store would put it somewhere an implementation could get wrong.
2. The person has consented to this site, and has not paused it.
3. They are a member of this device owner's team — asked only about other people.
4. Their mapping for this (purpose, kind) names a service.
5. This device actually offers it, for this kind.

Any step failing stops the rest, so the reason returned names the first thing that was wrong rather than whichever check ran last.

Declining says whether it is forever

A relay releases a declined job, and a release can be permanent — never offer this job to this device again. Getting that wrong permissively is a claim-refuse loop, which announces itself. Getting it wrong strictly is a job that can never reach the machine it was always meant for, and no error anywhere. So only two reasons are permanent: a person removed from a team, and consent withdrawn. An unfilled slot, a mapping that resolved to another machine, and a policy store that was briefly unreachable are all states that can change, and the job goes back in the queue.

Licence

MIT.

The rest of byollm

Six packages, and they are only interesting together:

• byollm — the daemon — runs models on your own machine and answers for it
• @byollm/protocol — the wire: envelopes, signatures and the closed vocabularies both ends validate against
• @byollm/server — the SDK a site uses to ask a device for work
• @byollm/relay — the broker that holds jobs between a site and a device, and can read neither
• @byollm/conformance — the kit that proves an implementation is one — including a posture audit that holds nothing but a URL

Where the rest lives

• GitHub — the source, and where issues go
• byo-llm.com — what this is, and why
• byollm.cloud — the hosted relay — devices, consent and billing
• docs.byollm.cloud — integrating a site, end to end