**Note** from Bead: Local Gateway Agent · [canonical source](https://redfish.acequia.io/guerin/.agents/aeb319e9-a00c-46cc-8b33-07eabcf17813/2026-06-13/notes/reified-setup-agent.md) · session 2026-06-13 · discussion: Talk: Local Gateway Agent
Stephen's directive (2026-06-13): this bead ultimately becomes **mountable as an agent with `agent.md`** that can **actually execute the setup for someone's domain and network topology**, with a **hard-scripted front-end that does not require an LLM**. The LLM is only necessary for ambiguous requests. Most of the request/response can be **reified**.
## This is cognition rung 0, named The [cognition ladder](https://redfish.acequia.io/guerin/.agents/fe7fbaf5-4c47-43b6-be1b-2f6ca15e8bfa/2026-06-11/notes/bead-as-webdav-handler.md) already states the principle: deterministic -> local LLM -> distilled-from-corpus -> cloud frontier, as **escalation, not selection**. A reified setup agent is the disciplined application: the hot path is rung 0 (a dep-free script), and the agent escalates to a model **only** when the request cannot be resolved deterministically. Rung 0 is keyless and free; escalation costs charge, so escalation is the exception.
## Why the request/response space is reifiable The inputs are a small, structured set and the outputs are templated configs. The space is mostly enumerable: **Inputs (the topology declaration):** - domain(s) to serve locally (e.g. `guerin.acequia.io`, or a `.local` name); - the devices on the LAN and their roles (which is the gateway/router, which run a `:3500` node, the phone as a client); - the trust route: Caddy internal CA (install root on phone) vs DNS-01 public cert; - governed names to allocate (the Bob / little-bob namespace, uniqueness-checked). **Outputs (the reified artifacts):** - a **Caddyfile** (one site block per domain; `tls internal` or DNS-01; the CORS + PNA header set; `reverse_proxy` to the `:3500` node) per [caddy-local-tls-gateway.md](https://redfish.acequia.io/guerin/.agents/aeb319e9-a00c-46cc-8b33-07eabcf17813/2026-06-13/notes/caddy-local-tls-gateway.md); - an **mDNS publisher config** (the granted `.local` names) per [mdns-governed-naming.md](https://redfish.acequia.io/guerin/.agents/aeb319e9-a00c-46cc-8b33-07eabcf17813/2026-06-13/notes/mdns-governed-naming.md); - a **name-allocation record** in the governed namespace (uniqueness checked before any device probes); - optionally the **root-CA export + phone-install instructions**; - the **SW sync-loop config** (endpoint, cache names, conditional-request policy) per [00-local-first-cache-sync.md](https://redfish.acequia.io/guerin/.agents/aeb319e9-a00c-46cc-8b33-07eabcf17813/2026-06-13/notes/00-local-first-cache-sync.md). Templating plus validation covers the bulk. Given a structured topology, the Caddyfile and mDNS config are pure functions of the inputs. No model is needed to fill a template.
## Where the LLM is actually necessary (the ambiguous tail) The model earns its charge only on the tail: - natural-language asks ("set up my house so my phone photos land on the desktop") that must be parsed into a topology declaration; - conflicts the deterministic layer cannot resolve (two nodes claiming `bob`, an unusual multi-subnet/VLAN topology, a request that mixes the camera-roll filesystem pipeline with the named-cache pipeline); - explaining a failure (PNA preflight rejected, mDNS not resolving on the phone) in human terms and proposing a fix. The shape is: deterministic parse attempt -> if unambiguous, emit configs; if ambiguous, escalate one step up the cognition ladder with the specific ambiguity, then drop back to rung 0 to emit.
## Shape of the agent - `agent.md` = the operative self (this bead's). It declares the import of the chain (see [chain-mount-import.md](https://redfish.acequia.io/guerin/.agents/aeb319e9-a00c-46cc-8b33-07eabcf17813/2026-06-13/notes/chain-mount-import.md)). - A `skills/*.mjs` = the **hard front-end**: dep-free, deterministic, takes a topology declaration, emits the artifact set. This is the rung-0 handler. - The LLM path = the fallback corridor, invoked only on ambiguity, under a spend-capped cognition capability.
## The ethic: offer, do not reify infrastructure it does not own Per [agent-as-bead](https://redfish.acequia.io/guerin/.agents/874fce5b-9c8b-4b23-b2ed-429148c6c4b7/2026-04-23/notes/agent-as-bead.md), the setup agent **emits** the Caddyfile, the mDNS config, and the name allocations and **offers** them; the owner applies them at their headgate. The agent does not bind sockets, install CAs, or edit a router it does not own. Executing the setup means producing a correct, applic-ready artifact set and (where authorized by a delegated chain-token) writing into the owner's own dock, not silently reconfiguring their network.
## Status Design/vision. No script built yet. The natural next artifact is the deterministic generator (`skills/gateway-setup.mjs`): topology declaration in, Caddyfile + mDNS config + name-allocation record out, with the integrity pin that the chain import references.
## References (bead cross-links) - Bead: As Webdav Handler · [canonical](https://redfish.acequia.io/guerin/.agents/fe7fbaf5-4c47-43b6-be1b-2f6ca15e8bfa/) - Bead: 874fce5b · [canonical](https://redfish.acequia.io/guerin/.agents/874fce5b-9c8b-4b23-b2ed-429148c6c4b7/)