> For the complete documentation index, see [llms.txt](https://tinyhumans.gitbook.io/openhuman/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://tinyhumans.gitbook.io/openhuman/developing/architecture/process-state.md). # Process state in shared cores Process state, tenant ownership and routing requirements for shared cores. This inventory tracks the named singleton candidates in [#7433](https://github.com/tinyhumansai/openhuman/issues/7433), under the [cloud-storage epic](https://github.com/tinyhumansai/openhuman/issues/7419). It records source review at `3dbdd07e5f07d917dabbbc93fb0a9dd2a24a4347`, with the MCP cleanup reservation added at `d1efa8bd58417a0715d3c93655985ccfa9c9759c`. PR evidence below was checked on October 12, 2026. It does not cover every static in the core or certify a cloud deployment. ## Classification The categories describe the required ownership boundary. A row can require more than one: * **A — process:** bootstrap settings, local execution handles or process capabilities. * **B — scoped:** state must retain its tenant, agent, session or connection owner. * **C — durable:** records need a backend document, stream, blob or claim. * **D — routing:** requests must reach the process that owns a live handle, or use an explicit executor-routing protocol. “Pending” means the boundary still needs a regression or implementation. A process-local table cannot provide a distributed claim just because a related record is durable. ### Configuration and identity Paths in the table are relative to `crates/openhuman-core/src/`. | State | Class | Current boundary and remaining work | | ----------------------------------------------------------- | ----- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | `security/credentials/identity.rs` `CURRENT_USER` | B | One process slot supplies prompt and tracing identity. Pending: trace authenticated profile admission and test interleaved identities before treating it as profile-owned state. | | `config/schema/load/active_workspace.rs` `ACTIVE_WORKSPACE` | A | Process bootstrap cache. Pending: verify profile operations cannot select another workspace through this fallback. | | `core/runtime/context.rs` `DEFAULT_CONTEXT` | A | Bootstrap context. SaaS tenant resolution uses the actual scoped context and refuses missing task context; the default is not a tenant authority. | | `agent/multimodal.rs` `ATTACHMENTS_DIR` | B, C | First-initialized local attachment directory. Attachment bytes and indexes need scoped blob ownership and an import path; see #7425. | | `threads/store/bus.rs` `CONVERSATION_PERSISTENCE_WORKSPACE` | A | Desktop subscriber installation explicitly refuses SaaS. This supplies no shared-core persistence or routing. | | `mcp/host.rs` `DEFAULT_CONFIG` | A, B | Replaces the issue's former `DEFAULT_WORKSPACE` name. Scoped clients capture configuration; missing SaaS context currently falls through to the process default. Pending refusal regression and fix. | | `core/logging.rs` `LOG_DIR` | A | Process logging destination. Cloud logging should use process output or a collector; directory state is not a tenant store. | | `config/schema/proxy.rs` proxy settings and clients | A, B | Process proxy policy and cached HTTP clients. Pending: establish operator-only mutation or capture profile policy; tenant configuration must not silently change another caller's routing. | | `config/schema/cli_overrides/ops.rs` `CLI_INFERENCE_STATE` | A | Launch overrides; persisted configuration is restored separately. This is process configuration, not durable tenant inference state. | | `agent/tinyagents/discovery` `SETTINGS` | B | Session construction overwrites one process policy, and turn assembly reads that slot. Pending interleaved-session regression; discovery policy needs a captured session owner. | | `storage/secrets.rs` `KEYS` | A | Caches the master provider. Native secret operations capture scope and derive scoped data keys. Pending production `current()` isolation controls; changing the master source requires restarting the process. Legacy adoption needs separate source-ownership admission. | | Connected-integration cache | B | Credential-only snapshots and global invalidation are corrected in [PR #7513](https://github.com/tinyhumansai/openhuman/pull/7513). Eight scope, diagnostic and epoch-reclamation controls, 363 Composio tests and five scoped-spawn controls pass. This is a pending PR, not released behavior. | ### Live execution and delivery | State | Class | Current boundary and remaining work | | ---------------------------------------------------- | ------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `agent/orchestration/busy_guard.rs` | B, D | Profile-keyed live-turn guards with exact guard cleanup. A second core cannot observe these guards; live turns need owner routing or durable claims. | | `agent/orchestration/completion_owners.rs` | B, D | Bounded IDs map to recorded profiles; delivery reopens trusted profile contexts. Restart or eviction can lose routing triggers. | | `agent/orchestration/background_completions.rs` | B, C, D | Workspace routers and profile-keyed gates; completion records still use workspace JSONL with a memory fallback. Shared delivery requires durable records and claims. | | `agent/orchestration/background_delivery.rs` | B, D | Profile-keyed local slots and scoped delivery tasks. Multiple executors need a shared delivery claim before publishing the same completion. | | `agent/orchestration/running_subagents` | B, C, D | [PR #7517](https://github.com/tinyhumansai/openhuman/pull/7517) captures tenant ownership in live registry keys and public controls. Seven host controls passed after six baseline failures. Review follow-ups remain: prove actual SaaS RPC admission and refuse missing-scope spawns before durable writes. Live handles still need executor routing. | | `agent/orchestration/workflow_runs/engine/cancel.rs` | A, D | UUID run IDs index generation-protected local signals. Public stop loads a scoped durable record first. Remote stop needs routing to the executing process; a durable row does not carry the signal. | | `threads/store/bus.rs` `CLAIMED_TURNS` | A | Bounded desktop channel/message deduplication; registration and claims are disabled in SaaS. No distributed or SaaS turn claim is provided. | ### Capabilities and module connections | State | Class | Current boundary and remaining work | | -------------------------------------------------------- | ------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `core/event_bind_tokens.rs` `STORE` | A, D | Random one-shot client-bound capabilities with expiry. SaaS SSE rejects desktop tokens or missing profiles before consumption and filters events by the captured profile. Route consumption to the minting process; do not copy token tables into tenant documents. | | `desktop/control/confirmation.rs` `TABLE` | B, D | Thread-bound local confirmations; SaaS excludes this domain. Pending tests for two embedded actors sharing a thread and for cancellation after module replacement. Ownership must include the original module instance. | | `security/approval/gate.rs` `GLOBAL_GATE` | B, C, D | Routes already include tenant/agent scope; waiters retain original document handles. Pending missing-policy fallback controls. Normal profile hosts supply their own policy; cross-core waiter delivery still needs routing. | | `composio/trigger_history.rs` | B, C | Process lifecycle owner of an opaque module archive lease. Workspace changes release the old captured client before opening another. The module owns durable history; native archive consumption and trustworthy event-profile propagation remain owner/host integration work. | | `mcp/module_client.rs` `CLIENTS`, `CLEANUP_RESERVATIONS` | B, D | Agent-directory keys reserve retiring clients and pending cleanup callbacks. These are process-local admission fences. Pending: retain the admitted module owner through close and receipt polling; prove workspace retention and path admission after failed cleanup. They do not provide a distributed lease. | | Browser `THREAD_SESSIONS` | B, D | Keys include scope directory and thread; sessions retain their original browser client. Normal profiles have distinct workspaces. Pending explicit same-workspace/different-profile collision test; route live browser handles to their owner. | | RPC HTTP host `REGISTRY` | A, D | UUID listener handles capture task and auth state; list/get/stop lack tenant ownership. SaaS excludes the Platform surface. Pin that exclusion; exposing listeners to tenants would require an explicit owner capability. | | Voice `IN_FLIGHT_CORRELATIONS` | B, D | Global correlation IDs and deferred replies through the current socket manager. SaaS headless services disable Socket.IO. Pending desktop reconnect/identity-switch controls: old work must retain its connection or refuse delivery. | ## Deployment constraints A load balancer must preserve the owner of live streams, approvals, workers, browser sessions and local capabilities. Reconnecting to another core requires an explicit handoff or typed refusal. Shared storage alone does not transfer an in-memory task, socket, cancellation signal or module handle. Desktop-only surfaces excluded by the SaaS preset must remain excluded until their ownership tests pass. Removing an exclusion is a capability change, even when its store has moved to a shared backend. Outstanding acceptance includes reproducing each leak candidate, shrinking the storage-bypass baseline, driver-matrix verification, and regression-tested desktop import. [PR #7519](https://github.com/tinyhumansai/openhuman/pull/7519) adds a declaration guard for new core statics and retains existing ownership records; 68 guard, lane and crate-chain tests pass. It does not expand macros or certify existing globals. The guard remains a pending PR. Prepared tests and source review do not satisfy the remaining execution requirements.