**Note** from Bead: Home Port Forward Hosting · [canonical source](https://redfish.acequia.io/guerin/.agents/7049c694-e45b-4116-a887-49e64885ac8e/2026-06-13/notes/01-origin-as-animator.md) · session 2026-06-13 · discussion: Talk: Home Port Forward Hosting
**Date:** 2026-06-13. Companion to [00-home-port-forward-hosting.md](00-home-port-forward-hosting.md). **Frame:** [bead-as-webdav-handler.md](https://redfish.acequia.io/guerin/.agents/fe7fbaf5-4c47-43b6-be1b-2f6ca15e8bfa/2026-06-11/notes/bead-as-webdav-handler.md) (sister bead `fe7fbaf5`). Stephen pointed the "what does :3500 serve?" question at the handler design. The answer: the home-port-forward setup is the **physical substrate** for the design's third runtime.
## The mapping is exact The handler note's [§3 liveness ladder](https://redfish.acequia.io/guerin/.agents/fe7fbaf5-4c47-43b6-be1b-2f6ca15e8bfa/2026-06-11/notes/bead-as-webdav-handler.md) names three runtimes. The top rung is: > **OS-process animator** — *Where:* a node the parciante runs. *Authority:* its own scoped WebDAV chain token + `ANTHROPIC_API_KEY`. *Cognition:* full agent loop. *Lifecycle:* daemon; lease-elected; apoptoses on policy. **This home machine, reachable at `https://stephenguerin.live/`, is exactly "a node the parciante runs."** What home-port-forward hosting provides that a laptop behind NAT does not: 1. **A stable public, TLS-terminated address** — so the animator is one origin in the [distributed-origin mesh](https://redfish.acequia.io/guerin/.agents/) (§5 "Ingress: serve and watch"), reachable by tunnel/LAN/closest-agent routing, not just locally. 2. **The synchronous lane** (§2) — a live process answering HTTP verbs in-band, `200`/`207` with a computed body. Without a public ingress there is no sync lane; only the dock/202 async lane works. 3. **Lease-holdable ingress** — to hold the lease for a path (leader election, hey-you-its-me §3) and have live agent-face requests route to it, the node must be addressable. Port-forward + DNS-home + Caddy = addressable. So the staging path for the :3500 origin is: | Stage | Origin on :3500 | Liveness rung | Proves | |---|---|---|---| | 0 | placeholder page | static (degenerate handler) | TLS + port-forward + DNS chain works end-to-end | | 1 | bead-tree static server (`uploads-server.mjs` lineage) — GET/PROPFIND/OPTIONS/PUT over a bead subtree | static + dock (202) | the WebDAV surface is publicly served; docks accept deposits | | 2 | full **animator daemon** — watches docks, runs the agent loop, serves the sync lane | computing/acting | the agent-face actually *thinks*; sync + async both live | **Do stage 0 first.** The whole point of the lockout caution and the safe-order runbook is to prove the dumb chain before adding the smart origin. A static page on :3500 behind Caddy behind the port-forward, served at a valid `https://stephenguerin.live/`, is the milestone that de-risks everything above it.
## Why home-hosting specifically (vs. a cloud VM) The handler design's economics (§5 "charge = budget") and the **self-sovereign** framing make the parciante's *own* node the natural animator host: credentials live in nodes, not the commons; the node holds the WebDAV chain token and the BYOK cognition key; spend is the parciante's own. A home node is the maximally self-sovereign substrate — the parciante literally owns the metal. The cost is residential-line fragility (dynamic IP, uptime), which is precisely what the runbook's dyndns + monitoring address.
## Carry-overs into the runbook - The Node origin should bind `localhost:3500` only (never `0.0.0.0`) — it's reachable *only* through Caddy. This is already the §2c/§5 security posture and matches the handler note's "authority is the caller's, not the bead's" / scope-gate discipline. - When stage 2 lands, the animator's two credentials (§5 "Two credentials, two planes") live in this node's `.credentials/`-discipline storage, never PUT to the commons. - The **Imunify360 block** (00 §1b) is a same-realm wrinkle worth flagging to the handler thread: if the animator ever drives HostGo cPanel (e.g. its own dyndns), it hits the same WAF — the home node needs whitelisting, or the namespace-plane operations should avoid cPanel entirely and stay on the nephele/WebDAV origins.
## Credential rule for this host (Stephen, 2026-06-13) Once `:3500` grows past the placeholder into a **web-reachable agentic host**, its cognition credential MUST be a provider **API key (BYOK)** — never an interactive AI **subscription** (Claude.ai / Claude Code / a provider app login). Canonical statements: [webdav-context §6 "when you DO serve"](https://redfish.acequia.io/skills/webdav-context/SKILL.md) and the [handler-note invariant](https://redfish.acequia.io/guerin/.agents/fe7fbaf5-4c47-43b6-be1b-2f6ca15e8bfa/2026-06-11/notes/bead-as-webdav-handler.md). Exempt: a bead only passively watching paths for "hey you, it's me" deposits. Since `stephenguerin.live` is internet-facing, this rule is **load-bearing here**, not theoretical.
## Bootstrap-bead design (Stephen, 2026-06-13) The first thing `:3500` should serve is a **bootstrap bead**, designed so the rule above is satisfied by *construction* — the host holds no cloud key at all: 1. **`agent.md` points to handler scripts *in the bead*.** The bead carries its own `handler.mjs` (and friends); `agent.json`'s `handler.browser.module` / process handler resolve to bead-local scripts. The node runs *those*, not a generic brain. 2. **No live LLM necessary.** The bootstrap handler is **cognition-rung 0** ([handler-note §5 ladder](https://redfish.acequia.io/guerin/.agents/fe7fbaf5-4c47-43b6-be1b-2f6ca15e8bfa/2026-06-11/notes/bead-as-webdav-handler.md)): deterministic JS — negotiation, routing, templated answers, dock accept (`202`), `names.json` resolution. A web-reachable host that runs **only** rung-0 deterministic scripts needs **no cognition credential whatsoever** — the credential rule is satisfied vacuously, not by carefully scoping a key. 3. **Cognition arrives as a CLIENT, not a server.** When real thinking is needed, a **local AI CLI opens a WebSocket connection *to* the node** and acts as a **client** — the node is the WebSocket **server**; the CLI is the **client** that brings cognition. Consequences: - The internet-facing node never embeds an LLM nor holds a cloud API key; it serves deterministic handlers + a WebSocket endpoint. - The cognition lives in the CLI's process (local model = rung 1–2, zero key; or a cloud model that carries *its own* API key per the rule — BYOK stays on the *client's* side, off the public host). - This is the cleanest possible reading of "declare/serve don't bind a brain": the public surface is dumb + deterministic; intelligence connects inward on demand and detaches. Naturally apoptotic — no client connected → no cognition → rung-0 only. 4. **Relation to router-as-bead (§8 Q7).** This bootstrap bead *is* the candidate router-bead: `agent.md` + bead-local `handler.mjs` dispatching, `names.json` as the node's mount table, deterministic hot path, WebSocket as the escalation channel to a connecting cognition client. Caddy stays the dumb TLS edge in front (per [02-caddy-as-ingress-router.md](02-caddy-as-ingress-router.md)). **Status:** bootstrap bead **scaffolded** 2026-06-13 as a child of this bead → [`82bd6fa4-4d5a-435b-9deb-ca930a82aa89`](https://redfish.acequia.io/guerin/.agents/82bd6fa4-4d5a-435b-9deb-ca930a82aa89/about.md) (slug `stephenguerin-live-router`; this bead `7049c694` is its **birth-parent**). It carries `agent.md` + `agent.json` + a tested deterministic rung-0 `handler.mjs` + `names.json`, **and now the generic `server.js` runtime** (built + tested 2026-06-13: agent-face, static, the **resolve-and-wait** bridge, and a dependency-free WebSocket cognition channel — see the child's [00-router-bead-brief.md](https://redfish.acequia.io/guerin/.agents/82bd6fa4-4d5a-435b-9deb-ca930a82aa89/2026-06-13/notes/00-router-bead-brief.md)). **GO-LIVE DONE (2026-06-13):** the `stephenguerin-live-origin` NSSM service was re-pointed from the stage-0 placeholder to `node server.js <child-bead> 3500` (runtime at `C:\caddy\origins\stephenguerin.live\`). `https://stephenguerin.live/` now serves the child bead's agent-face over Caddy TLS (verified: `/_status`, `OPTIONS`, negotiated `GET`). The placeholder `origin-server.mjs` remains in the serve dir as a fallback.
## Open question raised for the sister bead The handler note's [§8 Q7](https://redfish.acequia.io/guerin/.agents/fe7fbaf5-4c47-43b6-be1b-2f6ca15e8bfa/2026-06-11/notes/bead-as-webdav-handler.md) asks whether `start-bead <remote-url>` node-hosts/animates a *remote* bead, and whether the node's ingress router is itself a bead. **A publicly-addressable home node is the concrete place that question gets answered** — it is the first node that can actually host the router-bead and dispatch imported guest beads under attenuated authority. This bead (`7049c694`) is the infrastructure prerequisite for that experiment.
## References (bead cross-links) - Bead: As Webdav Handler · [canonical](https://redfish.acequia.io/guerin/.agents/fe7fbaf5-4c47-43b6-be1b-2f6ca15e8bfa/) - Bead: Stephenguerin.live Router Bead · [canonical](https://redfish.acequia.io/guerin/.agents/82bd6fa4-4d5a-435b-9deb-ca930a82aa89/)