Phase 8 C1/C2 + 9 W1 · designs: client & daemon · C1 · runtime arm

A machine is one of your computers running the hnx daemon. The daemon holds a long-lived connection back to the server (Socket.IO over WSS, the /ctl namespace) authenticated by a machine-scoped PAT — no inbound ports needed on the machine.

hnx enroll --server <url>        # creates the machine + prints enroll info
hnx daemon                       # runs the daemon

• Handshake & capabilities — the daemon advertises what it supports (chat, workspace, sessions, harness, runtime-config, …); the server soft-gates features on it.
• Inventory reports — every scan cycle the daemon probes installed agent runtimes (claude-code, codex, deepseek, opencode, pi …) and reports them. The agent instance is the primary inventory object: an installed runtime with no deploy row is registered as a detected instance — chatable immediately. Two consecutive not-installed reports remove it.
• Workspace listing — the chat "new session" directory picker lists one level of subdirectories through the daemon (server-side containment against the machine's base workspace).
• Executes jobs — profile deploys and harness installs/updates (see Remote deploy and Harness runtime management).
• Chat adapter host — spawns and supervises the per-agent ACP adapter processes for portal chat, with a pid ledger and boot sweep so orphans never survive.