Stated in agents/docs/system-overview.md:7-24, and worth reading as constraints rather than aspirations:

Signed control plane — every HTTP action is a signed DAG-CBOR envelope (Protocol).

Account isolation — persisted state belongs to one Seed account; queries must prove ownership.

Durable sessions — append-only event logs, replayed by sequence number.

Live clients — desktop subscribes over a signed WebSocket.

Secret redaction — API keys are encrypted at rest and never returned.

Visible tools — tool calls and results are durable events rendered in the UI.

Shared hypermedia behavior — read uses the same SDK code the CLI uses, never a shell-out.

Inspectable operation — a built-in /agents inspector and diagnostic logs.

Five verbs, one address space — new capability is a new address or callable, not a new provider tool.

Configuration is content — tools and memory are documents in the agent's Space.

The log is symmetric — the user holds the same verbs; every event names its actor.

Everything that executes is a run — turns, children, and scripts are rows in one tree that is also the queue.

The end-to-end path (agents/docs/system-overview.md:62-93), which touches nearly every concept in these docs:

The desktop sends a signed MessageSession action.

The server appends a durable user message and creates a run row for the turn, claimed inline on the interactive queue. Session status now derives as streaming.

It builds an in-memory Pi session from the provider record, the decrypted key, the agent's system prompt plus the shared runtime prompt and its <space> index, and the tool set: the five verbs plus whichever callables this thread has already expanded.

Pi runs the provider loop and emits streaming, tool, and final events.

Text deltas become session-partial service events → appendPartial over the WebSocket → rendered live.

Tool calls and results are appended as durable events stamped actor: 'agent'. A call for an unexpanded tool returns that tool's contract instead of an error, and the contract's presence in the transcript promotes the tool for the rest of the thread (touch-expand).

If the turn used delegate, each child gets its own run row; the parent parks on them without holding resources and resumes when they resolve.

The final assistant message is appended; the run finalizes — rolling child usage up, settling plan steps whose children all succeeded, recording any obligation it ended without meeting, and possibly firing a run-completed trigger.

Session status re-derives to idle, or error when the latest run failed.