pi-roundtable-mcp 0.8.0 → 0.9.1

package/CHANGELOG.md

@@ -5,6 +5,35 @@ The format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 
 ## [Unreleased]
 
+## [0.9.1] - 2026-10-10
+
+### Fixed
+
+- A remote run asked for while the host shuts down fails instead of starting a turn (`defaultConversation().answer` resolves a failed result rather than rejecting). Needs pi-roundtable 0.9.1.
+
+## [0.9.0] - 2026-10-09
+
+### Added
+
+- `remoteMcp({ principal })`: the id of the principal the dispatch token stands for, the primary owner by default, as in 0.8. The plugin declares the token as the identity `token:<toolNames.dispatch, or remote-mcp>` in its `identities`, which the host links to that principal at every start; a principal that does not exist, or the identity linked to someone else, stops the start.
+- `RemoteMcpMessages.memberRelayNote`: the note opening each relayed message when the token stands for someone who is not an owner; it falls back to a `relayNote` you give.
+
+### Changed
+
+- The connector form of `/<root> connector add` is accepted from every owner, as pi-roundtable's `CommandGuard.allows` sees them, not only the primary owner.
+- A default remote turn is the bound principal's, from `IDENTITY.speakerFor`, at their tier, and its conversation is recorded as private to them. Bound to the primary owner, as by default, the speaker is the owner's principal at the owner tier, so the prompt, memory, and tools are 0.8's; bound to a member, the turn reads their memory and offers only their tier's tools, and the persona and relay note name no owner. The host's own `answer` receives that speaker as a third argument.
+- `remoteMcp` requires `IDENTITY` (provided by the built-in `identity` plugin of pi-roundtable 0.9); a `testPlugin` test of it gives one with `principalOf`, `tierOf`, `speakerFor`, and `owners`.
+- Each remote session belongs to the principal it was opened for (`remote_agent_sessions.principal_id`, migration `remote-sessions-principal`); after the token moves to another principal, continuing a session of the earlier one answers `SESSION_NOT_FOUND`. Sessions 0.8 opened are handed to the primary owner at the start, and their conversations, which 0.8 recorded as shared, are adopted as private to them with `CONVERSATIONS.adopt`, so a single-owner host's remote turns stay 0.8's. Every start adopts each session's conversation for its principal again, so one a failed hand-over left shared becomes theirs at the next start; adopt never changes a conversation that is already someone's. `remoteMcp` therefore requires `CONVERSATIONS` too, and a `testPlugin` test of it gives one with `adopt`.
+- The buttons and menu of `/<root> mcp authorize` and `/<root> mcp token` check again, at each press, that whoever presses is an owner, so an owner revoked while the flow is open completes nothing.
+
+### Deprecated
+
+- `REMOTE_SPEAKER` in `default-conversation.ts`: remote turns are for the bound principal. It goes away in 1.0.
+
+### Fixed
+
+- The default remote turn finds the actions a restart left held: it reads them with `heldActions`, which restores them from the store, instead of `pendingConfirmation`, which knows only the conversations that ran a turn since startup, so an approval relayed as the first message after a restart confirms them again, as in 0.8. Needs pi-roundtable with the same fix.
+
 ## [0.8.0] - 2026-10-07
 
 - Release in lockstep with pi-roundtable 0.8.0; no package-specific behavior changes.

package/README.md

@@ -6,7 +6,7 @@ Two plugins for [pi-roundtable](https://github.com/wayne930242/pi-roundtable), t
   The owner adds an external MCP server (Notion, a calendar, anything that speaks MCP over HTTP) with a private Discord form, and the host gets the servers and a routing description for each, to give its agents.
   [ContextForge](#contextforge) holds every upstream server and its token.
 - `remoteMcp`: an MCP server over HTTP for agents outside Discord.
-  One endpoint relays turns to the owner's agent and returns the answer when polled.
+  One endpoint relays turns to the agent, for the owner or another principal the dispatch token stands for, and returns the answer when polled.
   Another offers Discord channel tools, only for the channels the owner granted on Discord.
 
 Bun only, like pi-roundtable.
@@ -20,7 +20,7 @@ The package name and public API are unchanged from the standalone repository.
 ## What you need
 
 - [Bun](https://bun.sh/docs/installation) 1.3 or newer.
-- A running pi-roundtable host, version 0.8 (`pi-roundtable` is a peer dependency, `>=0.8.0 <0.9.0`), with its PostgreSQL.
+- A running pi-roundtable host, version 0.9 (`pi-roundtable` is a peer dependency, `>=0.9.0 <0.10.0`), with its PostgreSQL.
 - For `mcpConnectors`: a [ContextForge](#contextforge) gateway that you run yourself.
 - For `remoteMcp`: an HTTPS address that reaches the host's `public` listener, such as a tunnel; this is the host's `http.publicUrl`.
 
@@ -34,6 +34,15 @@ After the lockstep release:
 bun add pi-roundtable-mcp
 ```
 
+## Principal migration in 0.9
+
+Follow [Migrating to 0.9](../../docs/migration-0.9.md) when changing the lockstep core and package together.
+The dispatch token defaults to the primary owner's principal; 0.8 sessions and schedule authors retain that attribution.
+The plugin registers its private scope before runtime use and converges pre-0.9 shared registry records through `CONVERSATIONS.adopt` on startup.
+Explicit `principal` bindings need an existing principal with a lasting role; only `token:` identities may be declared by plugins.
+A custom `answer` must run as the supplied speaker, never silently as the owner, and must record private ownership before a direct runtime call.
+The channel grants of `/mcp/discord/<token>` do not become per-principal grants in this release.
+
 ## Configure
 
 List the plugins in `roundtable.config.ts`.
@@ -161,9 +170,10 @@ The owner manages connectors on Discord with `/<root> connector`, where `<root>`
 | --- | --- | --- | --- |
 | `dispatchToken` | `string` | required | The bearer token an outside agent presents at `/mcp/personal`. Make it long and keep it secret |
 | `publicUrl` | `string` | required | The HTTPS address that reaches the host's `public` listener. Granted-channel URLs are built on its origin |
-| `persona` | `string` | a short neutral prompt | The system prompt of the default `remote` conversations |
+| `principal` | `string` | the primary owner | The id of the principal the dispatch token stands for: whose memory, schedules, conversations, and tier the remote turns have. See [whom the token stands for](#whom-the-token-stands-for) |
+| `persona` | `string` | a short prompt | The system prompt of the default `remote` conversations. The default names the owner when the token stands for an owner, and no one otherwise |
 | `answer`, `claim` | see [below](#when-the-host-runs-the-conversations-itself) | the core's runtime | Give both, or neither |
-| `messages` | `Partial<RemoteMcpMessages>` | English | The relay note, the tool descriptions, and the Discord text, in your wording. `dispatchDescription` and `resultDescription` are functions that receive the tool names |
+| `messages` | `Partial<RemoteMcpMessages>` | English | The relay notes (`relayNote` for an owner, `memberRelayNote` for anyone else, which falls back to your `relayNote`), the tool descriptions, and the Discord text, in your wording. `dispatchDescription` and `resultDescription` are functions that receive the tool names |
 | `toolNames` | `{ dispatch?: string; result?: string }` | `agent_dispatch`, `agent_result` | The names of the two tools at `/mcp/personal`, for agents that are already set up with other names. The default descriptions follow them |
 
 The plugin serves two endpoints on the host's `public` listener:
@@ -202,10 +212,12 @@ The tables belong to the plugin: change them through the plugin on Discord, or t
 
 #### The default conversation
 
-Without `answer` and `claim`, a relayed turn runs on the core: `context.turns.run` of kind `remote`, for an owner-tier speaker, in the channel `mcp:<session>`, through the agent server's runtime.
+Without `answer` and `claim`, a relayed turn runs on the core: `context.turns.run` of kind `remote`, for the principal the dispatch token stands for (`IDENTITY.speakerFor`, at their tier), in the channel `mcp:<session>`, through the agent server's runtime.
+The conversation is recorded as private to that principal.
 Nothing is posted to Discord, since no chat surface serves `mcp:` channels; the outside agent polls for the answer.
-A relayed message that the host's judge reads as approving held actions confirms them, as the owner's own reply would.
-Each message begins with a short note that says the owner wrote it in an outside agent.
+A relayed message that the host's judge reads as approving held actions confirms them, as the person's own reply would.
+Each message begins with a short note that says it was written in an outside agent: for an owner, the note and the persona name the owner, word for word as in 0.8; for anyone else they name no owner, so the agent does not take them for one.
+Which of the two is chosen at the start, by whether the principal then holds the owner role.
 Starting a remote conversation over archives it, and deleting it also ends the outside agent's session.
 Sessions that stay idle for 14 days are deleted once a day.
 
@@ -226,9 +238,10 @@ export function hostRemote(dispatchToken: string, publicUrl: string) {
 	return remoteMcp({
 		dispatchToken,
 		publicUrl,
-		answer: async (channel, text) => ({
+		// `speaker` is the principal the dispatch token stands for.
+		answer: async (channel, text, speaker) => ({
 			ok: true,
-			text: `Answered ${text.length} characters in ${channel}.`,
+			text: `Answered ${speaker.name}'s ${text.length} characters in ${channel}.`,
 		}),
 		claim: {
 			// The string names whose conversation it was: the host's own kind.
@@ -240,15 +253,34 @@ export function hostRemote(dispatchToken: string, publicUrl: string) {
 ```
 <!-- /example -->
 
-- `answer(channel, text)` runs one turn and never rejects.
+- `answer(channel, text, speaker)` runs one turn and never rejects.
+  `speaker` is whom the turn is for: the principal the dispatch token stands for, from `IDENTITY.speakerFor`.
+  Run the turn as `speaker`, such as by passing it to `context.turns.run`: its tier decides the tools and its principal the memory.
+  An `answer` that ignores it, such as one that runs every turn as the owner, gives whoever holds the token owner turns, and `principal` then only decides whose the sessions are.
   The plugin does not queue it, so it joins the channel's queue itself (`context.queue.run`).
   The host owns the conversations' kind and persona, so the plugin contributes no persona in this mode.
 - `claim` is what the claim over the `mcp:<session>` channels does with those conversations: `startFresh` (required; the string it returns is the conversation's kind), `deleteConversation` (required; the plugin removes the session record after it), and optional `stop` and `background`.
   A claim without `background` skips background turns.
 
+#### Whom the token stands for
+
+The dispatch token is the identity `token:<toolNames.dispatch, or remote-mcp>`, which the plugin declares in its `identities`.
+At every start the host links it to `principal`, or to the primary owner without one, as in 0.8.
+`roundtable principal list` shows it under that principal as `token:remote-mcp  (plugin remote-mcp)`, and `roundtable principal unlink` refuses it: change the option instead.
+The start stops when the principal does not exist, or when the identity is linked to someone else by the configuration or the CLI; the error names what to change.
+
+Bound to a member, a remote turn reads and changes the member's memory, and only the tools of their tier are offered; when the host runs the conversations itself, that holds only if its `answer` runs the turn as the `speaker` it receives.
+Give that member a lasting role with `roundtable principal grant <principal> member` (or `admin`).
+A remote turn does not record them as seen, so a member whose tier comes only from what a surface reports stops being served `access.backgroundStaleDays` (30 by default) after they were last seen elsewhere: every remote run fails until they are seen again.
+
+Changing `principal` and restarting moves the token.
+Each session belongs to the principal it was opened for: after a move, continuing a session of the earlier principal answers `SESSION_NOT_FOUND`, and moving back makes it continue.
+Sessions 0.8 opened belong to the primary owner.
+The tool descriptions the outside agent reads still say "the owner"; give `dispatchDescription` in `messages` for other wording.
+
 ## The grant and security model
 
-- **The dispatch token is the owner's voice.** Whoever holds it can send the owner's agent messages as the owner (owner tier, with every tool the owner's agent has), and can approve its held actions by saying so. Keep it secret, change it by changing the option, and serve the endpoint only over HTTPS.
+- **The dispatch token is the voice of the principal it stands for.** Whoever holds it can send the agent messages as that principal (the primary owner by default: owner tier, with every tool the owner's agent has), and can approve the held actions of its turns by saying so. Keep it secret, change it by changing the option, and serve the endpoint only over HTTPS.
 - **A bundle URL is a credential.** It carries 32 random bytes; only its SHA-256 hash is stored, and the URL is shown once, when the bundle is created or replaced. Everyone holding it can use every channel in the bundle with the operations granted there, and nothing else.
 - **The owner approves each grant on Discord.** Only the owner can use the commands. A grant needs the owner to hold *Manage Channels* in the channel, and both the owner and the bot to hold the Discord permissions behind every operation chosen, so a grant never exceeds what both may do. The pending choice expires after five minutes.
 - **Every call is checked again.** The grant, the guild, and the bundle's token are read after Discord is inspected, so a revoke or a replaced URL stops a call in flight. Each call is written to an audit table before it runs and marked afterwards.
@@ -275,7 +307,7 @@ Operation labels (`read`, `send`, ...) come from pi-roundtable and follow the ho
 ## Database
 
 Each plugin declares its migrations; the host runs them before any setup.
-Tables: `owner_connectors`; `discord_mcp_bundles`, `discord_channel_grants`, `discord_channel_audit`, `remote_agent_sessions`.
+Tables: `owner_connectors`; `discord_mcp_bundles`, `discord_channel_grants`, `discord_channel_audit`, `remote_agent_sessions` (with `principal_id`, the migration `remote-sessions-principal`).
 
 ## Development
 

package/examples/host-conversation.ts

@@ -9,9 +9,10 @@ export function hostRemote(dispatchToken: string, publicUrl: string) {
 	return remoteMcp({
 		dispatchToken,
 		publicUrl,
-		answer: async (channel, text) => ({
+		// `speaker` is the principal the dispatch token stands for.
+		answer: async (channel, text, speaker) => ({
 			ok: true,
-			text: `Answered ${text.length} characters in ${channel}.`,
+			text: `Answered ${speaker.name}'s ${text.length} characters in ${channel}.`,
 		}),
 		claim: {
 			// The string names whose conversation it was: the host's own kind.

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "pi-roundtable-mcp",
-	"version": "0.8.0",
+	"version": "0.9.1",
 	"description": "MCP connectors through ContextForge and a remote MCP endpoint for pi-roundtable",
 	"type": "module",
 	"license": "MIT",
@@ -40,12 +40,12 @@
 		"typebox": "1.3.34"
 	},
 	"peerDependencies": {
-		"pi-roundtable": ">=0.8.0 <0.9.0"
+		"pi-roundtable": ">=0.9.0 <0.10.0"
 	},
 	"devDependencies": {
 		"@biomejs/biome": "2.5.15",
 		"@types/bun": "1.4.2",
-		"pi-roundtable": "0.8.0",
+		"pi-roundtable": "0.9.1",
 		"typescript": "7.0.2"
 	}
 }

package/src/connectors/connector-commands.ts

@@ -314,7 +314,7 @@ export function connectorCommands(
 					interaction.customId !== CONNECTOR_MODAL_ID
 				)
 					return false;
-				if (!guard.isOwner(interaction)) return true;
+				if (!(await guard.allows(interaction))) return true;
 				await interaction.deferReply({ flags: MessageFlags.Ephemeral });
 				await guard.run(interaction, () => commands.submit(interaction));
 				return true;

package/src/remote-mcp/default-conversation.ts

@@ -11,20 +11,42 @@ import type { RemoteClaimHooks } from "./remote-claim.ts";
 /** The conversation kind of the default remote conversations, and of their persona. */
 export const REMOTE_KIND = "remote";
 
-/** The system prompt of the default remote conversations, unless the host gives its own. */
+/**
+ * The system prompt of the default remote conversations when the dispatch token stands for an
+ * owner, unless the host gives its own: 0.8's, word for word.
+ */
 export const DEFAULT_PERSONA =
 	"You are the owner's personal assistant. The owner is writing to you through an outside agent over MCP, not on Discord, and each message begins with a note saying so. Answer the owner directly.";
 
-/** Who the default turns are for: the owner, reached through an outside agent that holds the dispatch token. */
+/**
+ * The system prompt of the default remote conversations when the dispatch token stands for someone
+ * who is not an owner, unless the host gives its own: it names no owner, so the agent does not
+ * take them for one.
+ */
+export const MEMBER_PERSONA =
+	"You are a personal assistant. The person you serve is writing to you through an outside agent over MCP, not on Discord, and each message begins with a note saying so. Answer them directly.";
+
+/**
+ * Who the default turns were for in 0.8: the owner, reached through an outside agent that holds
+ * the dispatch token.
+ * @deprecated The turns are for the principal the dispatch token stands for, as
+ * `IDENTITY.speakerFor` gives them; 0.8's `remote-mcp` rows are the primary owner's. Goes away in 1.0.
+ */
 export const REMOTE_SPEAKER: Speaker = {
 	id: "remote-mcp",
 	name: "Remote agent",
 	tier: "owner",
+	principalId: "remote-mcp",
 };
 
 /** How the plugin runs a remote turn and a remote conversation's claim operations. */
 export interface RemoteConversation {
-	answer(channel: ChannelKey, text: string): Promise<TurnResult>;
+	/** Runs one turn for `speaker`, the principal the dispatch token stands for; never rejects. */
+	answer(
+		channel: ChannelKey,
+		text: string,
+		speaker: Speaker,
+	): Promise<TurnResult>;
 	claim: RemoteClaimHooks;
 }
 
@@ -34,9 +56,10 @@ type Parts = Pick<PluginContext, "queue" | "turns"> & {
 };
 
 /**
- * Runs remote turns on the core: `context.turns.run` of kind `remote` for an owner-tier speaker,
- * in the channel's queue, with nothing posted since no surface serves `mcp:` channels. A relayed
- * message that approves held actions confirms them, as the owner's reply would on Discord.
+ * Runs remote turns on the core: `context.turns.run` of kind `remote` for the speaker the token
+ * stands for, in a conversation private to them, in the channel's queue, with nothing posted since
+ * no surface serves `mcp:` channels. A relayed message that approves held actions confirms them,
+ * as the person's own reply would on Discord.
  */
 export function defaultConversation({
 	queue,
@@ -44,24 +67,35 @@ export function defaultConversation({
 	server,
 }: Parts): RemoteConversation {
 	return {
-		answer: (channel, text) =>
-			queue.run(channel, () =>
-				settleTurn(async () => {
-					const { runtime, approvals } = server();
-					const pending = runtime.pendingConfirmation(channel);
-					const confirmed =
-						pending !== undefined && (await approvals.approves(pending, text));
-					return turns.run({
-						channel,
-						kind: REMOTE_KIND,
-						text,
-						speaker: REMOTE_SPEAKER,
-						confirmed,
-						// The outside agent polls for the answer; no surface posts it.
-						reply: async () => undefined,
-					});
-				}, "remote turn"),
-			),
+		answer: (channel, text, speaker) =>
+			queue
+				.run(channel, () =>
+					settleTurn(async () => {
+						const { runtime, approvals } = server();
+						// Restored from the store: after a restart nothing is held in memory yet.
+						const pending = await runtime.heldActions(channel);
+						const confirmed =
+							pending !== undefined &&
+							(await approvals.approves(pending, text));
+						return turns.run({
+							channel,
+							kind: REMOTE_KIND,
+							text,
+							speaker,
+							conversation: { visibility: "private" },
+							confirmed,
+							// The outside agent polls for the answer; no surface posts it.
+							reply: async () => undefined,
+						});
+					}, "remote turn"),
+				)
+				// A host shutting down starts no turn: the run fails, and the caller may try again later.
+				.catch(
+					(error: unknown): TurnResult => ({
+						ok: false,
+						error: error instanceof Error ? error : new Error(String(error)),
+					}),
+				),
 		claim: {
 			stop: (channel) => server().runtime.stop(channel),
 			startFresh: async (channel) => {

package/src/remote-mcp/mcp-grant-commands.ts

@@ -89,7 +89,10 @@ export function mcpGrantCommands(
 					!interaction.customId.startsWith(GRANT_PREFIX)
 				)
 					return false;
-				await guard.run(interaction, () => flow.component(interaction));
+				// The flow outlives the command: an owner revoked since then completes nothing.
+				await guard.run(interaction, async () =>
+					flow.component(interaction, await guard.allows(interaction)),
+				);
 				return true;
 			},
 		}),

package/src/remote-mcp/mcp-grant-flow.ts

@@ -120,14 +120,19 @@ export class McpGrantFlow {
 		);
 	}
 
-	/** Buttons and the operations menu of a pending grant or rotation. */
-	async component(interaction: ButtonOrMenu): Promise<void> {
+	/**
+	 * Buttons and the operations menu of a pending grant or rotation; one pressed by someone who is
+	 * not an owner now (`owner` false) finds it expired, as anyone's but its starter's does. Whether
+	 * the presser is an owner is the caller's to check at each press; nothing assumes it.
+	 */
+	async component(interaction: ButtonOrMenu, owner: boolean): Promise<void> {
 		const text = this.#text;
 		const [action, id = ""] = interaction.customId
 			.slice(GRANT_PREFIX.length)
 			.split(":");
 		const pending = this.#pending.get(id);
 		if (
+			!owner ||
 			!pending ||
 			pending.userId !== interaction.user.id ||
 			pending.channelId !== interaction.channelId ||

package/src/remote-mcp/messages.ts

@@ -14,8 +14,13 @@ export const DEFAULT_TOOL_NAMES: RemoteToolNames = {
  * and what the owner reads in the Discord commands.
  */
 export interface RemoteMcpMessages {
-	/** Opens every relayed turn, so the agent knows where the message comes from. */
+	/** Opens every relayed turn, so the agent knows where the message comes from, when the dispatch token stands for an owner. */
 	relayNote: string;
+	/**
+	 * Opens every relayed turn when the dispatch token stands for someone who is not an owner; it
+	 * names no owner. A host that gives only `relayNote` has it open those turns too.
+	 */
+	memberRelayNote: string;
 	/** The reason an outside agent is told for a run that did not complete. */
 	runFailed: string;
 	/** Sent for a granted tool call that failed in a way the agent must not retry. */
@@ -118,6 +123,8 @@ export interface RemoteMcpMessages {
 export const REMOTE_MCP_MESSAGES: RemoteMcpMessages = {
 	relayNote:
 		"(The owner wrote this in a personal agent that relays it over MCP, not on Discord. Answer the owner directly, just as you would on Discord; the agent passes your reply back.)",
+	memberRelayNote:
+		"(This was written in a personal agent that relays it over MCP, not on Discord. Answer the person who wrote it directly, just as you would on Discord; the agent passes your reply back.)",
 	runFailed: "This run did not complete. Try again later.",
 	operationUnfinished:
 		"The operation did not complete. Check the audit log of the grants on Discord; do not retry automatically.",

package/src/remote-mcp/remote-agent.ts

@@ -1,7 +1,6 @@
 import { randomUUID } from "node:crypto";
 import type { ChannelKey, Logger, TurnResult } from "pi-roundtable";
 import { REMOTE_MCP_MESSAGES, type RemoteMcpMessages } from "./messages.ts";
-import type { RemoteSessionStore } from "./remote-session-store.ts";
 
 /** A dispatch the caller should fix rather than retry as is. */
 export class RemoteAgentError extends Error {
@@ -23,9 +22,16 @@ interface Run {
 	finishedAt?: number;
 }
 
+/** The sessions of the principal the dispatch token stands for. */
+interface RemoteSessions {
+	create(): Promise<string>;
+	/** Marks their session used; false when they have no such session. */
+	touch(id: string): Promise<boolean>;
+}
+
 export interface RemoteAgentOptions {
-	sessions: Pick<RemoteSessionStore, "create" | "touch">;
-	/** Runs one owner turn in the session's channel; never rejects. */
+	sessions: RemoteSessions;
+	/** Runs one turn in the session's channel for the principal the token stands for; never rejects. */
 	answer(channel: ChannelKey, text: string): Promise<TurnResult>;
 	logger: Logger;
 	/** A run still working after this long is reported failed. */
@@ -43,8 +49,9 @@ export const remoteChannel = (sessionId: string): ChannelKey =>
 	`mcp:${sessionId}`;
 
 /**
- * Turns an outside agent relays for the owner. A dispatch returns at once; the caller polls
- * the run. Runs live in memory: a restart forgets them, but not their sessions.
+ * Turns an outside agent relays for the principal the dispatch token stands for. A dispatch
+ * returns at once; the caller polls the run. Runs live in memory: a restart forgets them, but not
+ * their sessions.
  */
 export class RemoteAgent {
 	readonly #options: RemoteAgentOptions;

package/src/remote-mcp/remote-mcp-plugin.ts

@@ -1,11 +1,16 @@
 import {
 	AGENTS,
 	type ChannelKey,
+	CONVERSATIONS,
 	ConfigError,
 	type Contribution,
 	definePlugin,
+	IDENTITY,
+	type IdentityService,
 	type PluginContext,
+	PluginError,
 	type RoundtablePlugin,
+	type Speaker,
 	type TurnResult,
 } from "pi-roundtable";
 import { DISCORD } from "pi-roundtable/discord";
@@ -13,6 +18,7 @@ import { ChannelGrantStore } from "./channel-grants.ts";
 import {
 	DEFAULT_PERSONA,
 	defaultConversation,
+	MEMBER_PERSONA,
 	REMOTE_KIND,
 	type RemoteConversation,
 } from "./default-conversation.ts";
@@ -20,6 +26,7 @@ import { McpGateway } from "./mcp-gateway.ts";
 import { mcpGrantCommands } from "./mcp-grant-commands.ts";
 import {
 	DEFAULT_TOOL_NAMES,
+	REMOTE_MCP_MESSAGES,
 	type RemoteMcpMessages,
 	type RemoteToolNames,
 	remoteMcpMessages,
@@ -48,11 +55,21 @@ interface RemoteMcpBaseOptions {
 	 * `agent_dispatch` and `agent_result` by default. The default descriptions follow the names.
 	 */
 	toolNames?: Partial<RemoteToolNames>;
+	/**
+	 * The id of the principal the dispatch token stands for: whose memory, schedules, conversations,
+	 * and tier the remote turns have. The primary owner, the first of `access.owners`, by default,
+	 * as in 0.8. The token is the identity `token:<toolNames.dispatch, or remote-mcp>`, which the
+	 * host links to this principal at every start; a principal that does not exist stops the start.
+	 */
+	principal?: string;
 }
 
 /** Remote turns run on the core's runtime: nothing more to give. */
 export interface DefaultConversationOptions {
-	/** The system prompt of the `remote` conversations; a short neutral one by default. */
+	/**
+	 * The system prompt of the `remote` conversations. By default a short one that names the owner
+	 * when the token stands for an owner at the start, and names no one otherwise.
+	 */
 	persona?: string;
 	answer?: undefined;
 	claim?: undefined;
@@ -61,11 +78,16 @@ export interface DefaultConversationOptions {
 /** The host runs the remote turns itself, and says what its conversations do. */
 export interface HostConversationOptions {
 	/**
-	 * Runs one turn for the owner in the session's channel and never rejects. It runs inside the
-	 * channel's queue (`context.queue.run`) itself, and the conversation it opens has a persona of
-	 * the host's own.
+	 * Runs one turn in the session's channel and never rejects. It runs inside the channel's queue
+	 * (`context.queue.run`) itself, and the conversation it opens has a persona of the host's own.
+	 * `speaker` is whom the turn is for: the principal the dispatch token stands for, from
+	 * `IDENTITY.speakerFor`.
 	 */
-	answer(channel: ChannelKey, text: string): Promise<TurnResult>;
+	answer(
+		channel: ChannelKey,
+		text: string,
+		speaker: Speaker,
+	): Promise<TurnResult>;
 	/** What the claim over the remote channels does with those conversations. */
 	claim: RemoteClaimHooks;
 	persona?: undefined;
@@ -89,6 +111,10 @@ function toolNamesOf(options: RemoteMcpOptions): RemoteToolNames {
 	return names;
 }
 
+/** The identity the dispatch token is: `token:<toolNames.dispatch, or remote-mcp>`. */
+const tokenIdentity = (options: RemoteMcpOptions): string =>
+	`token:${options.toolNames?.dispatch ?? "remote-mcp"}`;
+
 function checkOptions(options: RemoteMcpOptions): void {
 	if (!options.dispatchToken)
 		throw new ConfigError("remote-mcp: dispatchToken is empty");
@@ -102,33 +128,66 @@ function checkOptions(options: RemoteMcpOptions): void {
 }
 
 /**
- * An MCP server over HTTP for outside agents: `/mcp/personal` relays turns to the owner's agent
- * and returns the result when polled, and `/mcp/discord/<token>` offers the Discord channel
- * tools granted to one bundle. Grants are approved on Discord with `/<root> mcp`.
- * Provides `REMOTE_MCP`.
+ * An MCP server over HTTP for outside agents: `/mcp/personal` relays turns, for the principal the
+ * dispatch token stands for, to the agent and returns the result when polled, and
+ * `/mcp/discord/<token>` offers the Discord channel tools granted to one bundle. Grants are
+ * approved on Discord with `/<root> mcp`. Provides `REMOTE_MCP`.
  */
 export function remoteMcp(options: RemoteMcpOptions): RoundtablePlugin {
 	checkOptions(options);
 	const text = remoteMcpMessages(options.messages);
 	const toolNames = toolNamesOf(options);
+	const identity = tokenIdentity(options);
 	return definePlugin({
 		name: "remote-mcp",
-		requires: [DISCORD],
+		requires: [DISCORD, IDENTITY, CONVERSATIONS],
 		provides: [REMOTE_MCP],
-		migrations: [ChannelGrantStore.migration, RemoteSessionStore.migration],
+		identities: [
+			{
+				identity,
+				...(options.principal === undefined
+					? {}
+					: { principal: options.principal }),
+			},
+		],
+		migrations: [
+			ChannelGrantStore.migration,
+			...RemoteSessionStore.migrations(),
+		],
 		setup: async (context) => {
 			const { services, logger, conversations, database } = context;
 			const discord = services.get(DISCORD);
+			const identities = services.get(IDENTITY);
+			const bound = await boundPrincipal(identities, identity);
 			const conversation = conversationOf(options, context);
 			const grants = await ChannelGrantStore.attach(database());
 			const sessions = await RemoteSessionStore.attach(database());
+			// 0.8's sessions were the owner's, and their conversations, recorded shared, become theirs.
+			const registry = services.get(CONVERSATIONS);
+			const [primary] = await identities.owners();
+			if (primary)
+				await sessions.adopt(primary.id, async (id) => {
+					await registry.adopt(`mcp:${id}`, primary.id);
+				});
+			// Every start adopts each session's conversation for its principal again, so one a failed
+			// hand-over left no one's becomes theirs; adopt never changes one already someone's.
+			for (const { id, principalId } of await sessions.owned())
+				await registry.adopt(`mcp:${id}`, principalId);
 			const gateway = new McpGateway({
 				dispatchToken: options.dispatchToken,
 				agent: new RemoteAgent({
-					sessions,
-					answer: conversation.answer,
+					sessions: {
+						create: () => sessions.create(bound.id),
+						touch: (id) => sessions.touch(id, bound.id),
+					},
+					answer: async (channel, relayed) =>
+						conversation.answer(
+							channel,
+							relayed,
+							await identities.speakerFor(bound.id),
+						),
 					logger,
-					messages: text,
+					messages: { ...text, relayNote: relayNoteOf(options, bound) },
 				}),
 				grants,
 				executor: () => discord.connection.channelExecutor(),
@@ -156,12 +215,42 @@ export function remoteMcp(options: RemoteMcpOptions): RoundtablePlugin {
 				],
 				http: gateway.routes(LISTENER),
 				channels: [remoteClaim(conversation.claim, sessions)],
-				...personaOf(options),
+				...personaOf(options, bound),
 			} satisfies Contribution;
 		},
 	});
 }
 
+/** The principal the dispatch token stands for, and whether they held the owner role at the start. */
+interface Bound {
+	id: string;
+	owner: boolean;
+}
+
+/** Whom the identity plugin linked the dispatch token to at this start. */
+async function boundPrincipal(
+	identities: IdentityService,
+	identity: string,
+): Promise<Bound> {
+	const id = await identities.principalOf(identity);
+	if (id === undefined)
+		throw new PluginError(
+			`remote-mcp: ${identity}, the dispatch token's identity, is linked to no principal. The built-in identity plugin links it at the start; an IDENTITY that replaces it must link the identities plugins declare.`,
+		);
+	return { id, owner: (await identities.tierOf(id)) === "owner" };
+}
+
+/** The note opening every relayed message: the owner's, or for anyone else one that names no owner. */
+function relayNoteOf(options: RemoteMcpOptions, bound: Bound): string {
+	const given = options.messages;
+	if (bound.owner) return given?.relayNote ?? REMOTE_MCP_MESSAGES.relayNote;
+	return (
+		given?.memberRelayNote ??
+		given?.relayNote ??
+		REMOTE_MCP_MESSAGES.memberRelayNote
+	);
+}
+
 /** The host's own turns, or the default ones over the core's runtime. */
 function conversationOf(
 	options: RemoteMcpOptions,
@@ -171,9 +260,16 @@ function conversationOf(
 	return defaultConversation({ queue, turns, server: services.lazy(AGENTS) });
 }
 
-/** The persona of the default conversations; a host that runs its own brings its own. */
-function personaOf(options: RemoteMcpOptions): Pick<Contribution, "personas"> {
+/**
+ * The persona of the default conversations, the owner's or one that names no owner, as the token
+ * stands for at the start; a host that runs its own brings its own.
+ */
+function personaOf(
+	options: RemoteMcpOptions,
+	bound: Bound,
+): Pick<Contribution, "personas"> {
 	if (options.answer) return {};
-	const prompt = options.persona ?? DEFAULT_PERSONA;
+	const prompt =
+		options.persona ?? (bound.owner ? DEFAULT_PERSONA : MEMBER_PERSONA);
 	return { personas: [{ kind: REMOTE_KIND, prompt: () => prompt }] };
 }

package/src/remote-mcp/remote-session-store.ts

@@ -2,7 +2,10 @@ import { randomUUID } from "node:crypto";
 import type { SQL } from "bun";
 import type { Migration } from "pi-roundtable";
 
-/** The conversations outside agents opened with the owner's agent, so they survive a restart. */
+/**
+ * The conversations outside agents opened with the agent, each the principal's the dispatch token
+ * stood for when it was opened, so they survive a restart and stay theirs.
+ */
 export class RemoteSessionStore {
 	readonly #sql: SQL;
 
@@ -23,21 +26,66 @@ export class RemoteSessionStore {
 		},
 	};
 
+	/** Whose each session is: null for one 0.8 opened, which `adopt` gives the primary owner. */
+	static readonly principalMigration: Migration = {
+		name: "remote-sessions-principal",
+		up: async (sql) => {
+			await sql`ALTER TABLE remote_agent_sessions ADD COLUMN IF NOT EXISTS principal_id text`;
+		},
+	};
+
+	/** Both, in order: what a pool needs before the store attaches. */
+	static migrations(): Migration[] {
+		return [
+			RemoteSessionStore.migration,
+			RemoteSessionStore.principalMigration,
+		];
+	}
+
 	/** The store over the host's migrated pool. */
 	static async attach(sql: SQL): Promise<RemoteSessionStore> {
 		return new RemoteSessionStore(sql);
 	}
 
-	async create(): Promise<string> {
+	/**
+	 * Gives the sessions of no principal, which 0.8 opened for the owner, to the primary owner,
+	 * calling `handOver` with each one's id before it commits: a `handOver` that throws leaves them
+	 * all unowned for the next start to hand over again. Resolves the ids handed over.
+	 */
+	async adopt(
+		principalId: string,
+		handOver: (id: string) => Promise<void>,
+	): Promise<string[]> {
+		return this.#sql.begin(async (tx) => {
+			// The row locks make a start racing this one wait, then find none left to hand over.
+			const rows: { id: string }[] = await tx`
+				UPDATE remote_agent_sessions SET principal_id = ${principalId}
+				WHERE principal_id IS NULL RETURNING id`;
+			for (const { id } of rows) await handOver(id);
+			return rows.map((row) => row.id);
+		});
+	}
+
+	/** Every session that is someone's, with whose it is. */
+	async owned(): Promise<{ id: string; principalId: string }[]> {
+		return this.#sql`
+			SELECT id, principal_id AS "principalId" FROM remote_agent_sessions
+			WHERE principal_id IS NOT NULL ORDER BY id`;
+	}
+
+	async create(principalId: string): Promise<string> {
 		const id = randomUUID();
-		await this.#sql`INSERT INTO remote_agent_sessions (id) VALUES (${id})`;
+		await this.#sql`
+			INSERT INTO remote_agent_sessions (id, principal_id) VALUES (${id}, ${principalId})`;
 		return id;
 	}
 
-	/** Marks the session used; resolves false when it does not exist. */
-	async touch(id: string): Promise<boolean> {
+	/** Marks the principal's session used; resolves false when they have no such session. */
+	async touch(id: string, principalId: string): Promise<boolean> {
 		const rows = await this.#sql`
-			UPDATE remote_agent_sessions SET last_used_at = now() WHERE id = ${id} RETURNING id`;
+			UPDATE remote_agent_sessions SET last_used_at = now()
+			WHERE id = ${id} AND principal_id = ${principalId}
+			RETURNING id`;
 		return rows.length > 0;
 	}
 
@@ -46,7 +94,7 @@ export class RemoteSessionStore {
 		await this.#sql`DELETE FROM remote_agent_sessions WHERE id = ${id}`;
 	}
 
-	/** Sessions last used before the cutoff. */
+	/** Sessions last used before the cutoff, whoever's they are. */
 	async idleSince(cutoff: Date): Promise<string[]> {
 		const rows: { id: string }[] = await this.#sql`
 			SELECT id FROM remote_agent_sessions WHERE last_used_at < ${cutoff} ORDER BY last_used_at`;