**Note** from Bead: Collaborative Beads · [canonical source](https://redfish.acequia.io/guerin/.agents/48a76785-d7a3-4fee-99f5-84b57fb158ba/2026-06-19/notes/00-membrane-design.md) · session 2026-06-19 · discussion: Talk: Collaborative Beads
> "we are making an acequia together joining our AIs and having a membrane" — Stephen, 2026-06-19
## The frame Stephen and Manav each hold a private AI memory: - **Hubler** (Stephen) — the bead commons under `guerin/.agents/`, made queryable by the `bead-orama` Orama index (bead `6f5044df`). It is a *lexical pointer-index*: it ranks files/beads and points back into the commons, where the full text already lives (it is Stephen's own tree). - **Manav** — a self-hosted RAG service (bead `86f63509`) over his Claude conversations + reference docs. It is *grounded generative QA*: PII-screened at ingest, ChromaDB vector store, Gemini embed/generate, served over an ephemeral Cloudflare quick-tunnel. It returns a cited answer + screened source excerpts + whole documents, **never** raw chat history, and refuses honestly when ungrounded. We want one acequia *together*. The instinct to merge — copy Manav's vectors into Hubler's index, or vice versa — is wrong. It would dissolve ownership, leak the privacy screen, and force two incomparable retrieval models into one. What we want is a **membrane**: a boundary that lets the *right* thing through and holds the rest back.
## What crosses, what doesn't A membrane is **semipermeable**. Across this one: - **Crosses:** the *question*. That is all. - **Comes back:** results, each **tagged with its origin**, in each side's native shape (Hubler → ranked pointers; Manav → a grounded answer + sources). - **Never crosses:** the corpora themselves. No copy, no mirror. Each store stays where it lives and stays authoritative. Manav's PII screen and no-raw-chat policy stay *upstream in his service*; the membrane does not re-implement or peel them back. It cannot leak what it never receives. This is the cell-membrane metaphor taken literally: two cells, each with its own cytoplasm, exchanging signals — not fusing into one bag.
## Why not fuse the rankings Hubler scores with an Orama BM25-ish lexical score; Manav returns cosine *distance* plus a *synthesized answer*. These scales are not comparable, and the two outputs are not even the same kind of object (a list of pointers vs. one generated paragraph). So the membrane **braids and labels** instead of fusing: both sides' nodes land in one `braided` array, each carrying `origin`, and the reader (human or agent) weighs them on their own terms. Score fusion is a possible future refinement, not a thing to fake now.
## Semipermeable under partition Manav's tunnel URL is ephemeral and his machine may be off. A membrane that blocks on the dead side is a wall, not a membrane. So both sides are queried concurrently and **fail soft**: if Manav is unreachable, Hubler results still return (and vice versa), with the failure recorded in `errors[]`, not thrown. This is the constraint-is-soft / partition-tolerant property (cf. `feedback_every-constraint-is-soft`, `decentralized-cache-management`) applied to a two-party join: each peer holds its own state; coherence is best-effort, never a barrier.
## Asymmetry is real, and named as a next saca Today the membrane is **one-way**: this bead is a *client* of Manav's public API, and it can read Hubler directly because Hubler is local to it. A *reciprocal* membrane — Manav's agent querying the Hubler commons — needs a Hubler-side query endpoint. The `bead-orama` agent-face already sketches one (`GET ?q=` / `POST search` intercepted by `acequia-sw.js`). Standing that up, with a scoped token for Manav, turns the one-way membrane into a two-way one and makes the shared acequia mutual. That is the obvious next step.
## Open questions for Stephen 1. **Reciprocity.** Stand up the Hubler `GET ?q=` endpoint + a scoped token for Manav, so the membrane is two-way? (Turns "I can query you" into "we query each other.") 2. **Permeability policy.** Should the Hubler side ever screen what it returns to a foreign agent (some beads are marked internal, e.g. `redfish-simtable-strategy`), or is the membrane's job purely transport, leaving ACLs to the `.acequia-access` sidecars? (Lean: ACLs upstream, membrane stays dumb transport.) 3. **Discovery.** Manav's `BASE_URL` is ephemeral. Park the current URL where — this bead's `uploads/` dock, a shared `names.json` mount, or wait for his named tunnel? (Today: passed at call time, never hardcoded.) 4. **Fusion.** Worth a unified cross-ranking later, or is braided-and-labeled the honest end state given the incomparable scales?