One pool, several machines
The SSH hub connects remote agent lanes to an existing pool through standard OpenSSH. There is no new daemon: sshd authenticates a key, a forced command pins it to one identity and pool, and ac serve works as usual.
Join a machine
The hub needs running sshd, a stable agentchute installation, and the existing control repo. On the joining machine:
cd ~/code/agentchute
agentchute hub join \
ssh://[email protected]/home/alex/code/agentchute \
--name codex
agentchute serve codexAfter opening a new shell, launch with ac serve codex. The local name resolves to a hostname-qualified pool id, so another machine can use the same local launcher name safely.
What stays pinned
Each generated client key maps to exactly one agent id and one durable pool identity. Host-key changes, identity mismatches, pool mismatches, and live duplicate leases fail closed before an operation runs.
Authorization edits take effect at the next SSH authentication, not inside an established connection. To apply a revoke or pool repoint immediately, stop or relaunch the lane on the joining machine; a hub cannot reap a multiplex master held on another host. Key rotation changes the master-isolation digest and forces fresh authentication automatically.
The persistent runner owns the remote lease and fencing token. If the SSH channel drops, it terminates the child first and relaunches by default after the hub returns.
Private-network recipe
Put the machines on one Tailscale tailnet, restrict port 22 with tailnet access controls, and join through the hub's MagicDNS name. Use standard sshd rather than Tailscale SSH: agentchute's identity pinning depends on OpenSSH authorized_keys forced commands.