Cloud Groups: bind local PersonaBots and verify two-Host UAT collaboration #2155

Parent: BotHarness/tob#5
Depends on the public cloud protocol in BotHarness/tob#24 and mobile #2154 (stacked, unmerged).

Observable behavior

The local Human imports one trusted channel Agent credential, explicitly binds it to a PersonaBot in the existing Apps surface, and sees cloud-origin messages and correlated replies through the existing Messaging owner. The same configuration and observations are available through deepseekbot CLI. Continue into the bounded health-check forwarding path on two isolated local Hosts using Cloudflare UAT.

Boundaries

• Cloud service TOB is distinct from the protected local steward named Tob.
• Native Credentials Provider stores secret values; BotHarness Operational Database stores public connection metadata, local policy and checkpoints. No second source-message or Session store.
• Messaging owns external Source Events, placement, Admission and Outbox. Cloud Human is bridged, never authenticated local Human. External Agent is not a local PersonaBot.
• Only explicit bindings and selected cloud channels are imported. No local private chats, Memory, Session or files automatically upload.
• Trusted instance identity is checked before credential use. Configuration drift, revocation, inactive membership and unknown actors fail closed.
• Checkpoints never advance before durable source admission; replay remains idempotent. Sends use the durable Outbox operation identity.
• Only a bounded fixed check/forward operation is executable; preserve original Human/capability/deadline and one-hop protocol. Local operator allow-lists and target grants remain independent from cloud membership. No Workspace Grant, native approval or private-input bypass.
• Actual DSH Tool and no-model CLI use the same owner. Agent result text does not recursively trigger another Agent.

Verification

• CLI import/list/remove and explicit PersonaBot binding; existing/new desktop control through the same Host owner.
• Focused provider/credential lifecycle, source provenance, replay and Outbox tests.
• Two independently launched Profiles/Hosts with separate Bot identities, credentials, operational databases and Session logs; all inter-Host traffic through actual Cloudflare UAT.
• Mobile-origin fixed request → real model A uses bounded forwarding → B checks original Human/local policy → same cloud channel result. Correlate public cloud sequence, local Source Event, Tool call and durable outcome.
• Reconnect/replay does not execute completed work; denial and loop boundaries observed. Final c183a2d evidence adds live original-Human removal, target removal, second-hop/self-forward and execute-after-forward refusal; authorized completed replay adds no execution or messages.
• Public-safe screenshots/recording, exact runtime heads, CI and remaining native/Human gates on Draft PR.

UAT only, no Prod, no merges. The Human has authorized autonomous implementation/testing and two isolated local Hosts. Shared native/Host resource coordination remains required; no resource is reserved by this issue alone.

Current UAT evidence — 2026-10-18

Draft #2157, evidence head d90f28b. Mobile JS247a727b8 / Host runtimef02c2423b / cloud3eeed5b. Actual mobile UI → native model A forward → B execute → mobile visible result (seq16/17/18, A0/B1). Earlier both-Host restart replay kept the same child and added no execution/messages. Source CI39095884899 passed. English screenshots and two recordings are published.

Independent synthetic staging session refresh/cold restart/logout and A/B CLI isolation passed. Hosted AuthKit/PKCE was not re-proved in this run. Local policies restored; own Metro/driver stopped; shared lane released. Retained first failures and cleanup evidence are in the PR.

The replay/denial checklist remains open for broader real-runtime revocation/loop verification; source/protocol assertions are not substituted for every Host runtime case. Android/physical-device/Human QA, WebSocket and organization-wide Agent membership remain separately tracked. No merge or Prod.

Merge outcome — 2026-10-18

Human authorized merge and closure of completed slices. PR #2157 was integrated with its original commits through #2157 into main. This issue’s bounded implementation and recorded UAT path are complete. Source, Simulator, real UAT and historical Human-assisted browser evidence retain their published boundaries; no new physical-device/Android/Human acceptance is implied. Broader identity-event revocation, WebSocket, org-wide Agents and T1–T5 acceptance remain in BotHarness/tob#1 and its child tasks. No Prod deployment or release.

Agent task codex/local/01a148ae-ec7f-74b2-8157-961411ce54c9: completed for this bounded slice.