@network-harness/core-llm

Claims ctx.llm. The node's intelligence, as a queue rather than a call: a protocol starts a run and gets an id, and the validated result arrives later as an event in its own context.

Two processes, one store. The service is mounted twice over the same SQLite file: mode: "loop" in the daemon starts runs, reads finished turns, and dispatches the events; mode: "worker" in the executor process claims turns and runs them, and starts nothing. The split is where the risk is -- spawning a model is heavy and unpredictable, and the daemon has to keep answering while one runs.

One active turn per node. The claim is a single statement that refuses if any turn is already running. This is not about throughput: a claimed turn immediately spawns a model, so a node that claimed two would spend the human's budget on work nobody asked for, and the order of a run's turns would stop being knowable. A turn that was running when the process stopped is failed rather than resumed, because a model ran and nobody knows what it did.

The subject is recorded before the run exists. It goes in with the run and its first turn, in one transaction, so a run's output can never choose what the run was about.

The output contract lives here, once. The schema a protocol declares is stated in the prompt and enforced on the reply, so the two cannot disagree. A reply that does not meet it gets exactly one correction turn; a second failure is the run's answer. This is the code four protocols would otherwise each carry a copy of.

Untrusted text is delimited, and the delimiters are refused. A protocol's instructions, the context it selected, and any prompt it appends are checked for the block markers and rejected -- escaping would leave the model to interpret the escape. Text the loop composes itself (a validator's complaint, which may quote the model) is neutralized instead, so a run never fails for a reason unrelated to what the model did.