AcpConfig.stream is runtime-only. Production configuration selects provider and model, then uses NDJSON over stdin and stdout.Choose the owner before the carrier.
Simple and disposable, with startup cost and no continuity.
Strong workspace and credential separation with higher process density.
Share only a reviewed capability and policy boundary.
Efficient, but every Session shares one teardown lifetime.
A gateway owns five contracts.
Exact artifact, clean stdout, deadlines, generations, bounded restart.
Requests and reverse permissions return to one authenticated owner.
Every Session stays on the connection that created it.
Declare cancel, replay, or durable job behavior on disconnect.
Close admission, drain, cancel at deadline, and verify exit.
Tenant identity comes from server state, never model or client arguments.
Use opaque tenant-bound handles, quotas, replay limits, permission expiry, log redaction, and a container-class boundary for untrusted code.
Failure must stay generation-scoped.
A child restart invalidates its Session ids. A malformed stdout frame terminates that generation. A rolling deploy stops admission before drain. No old handle may silently alias a new process.
Primary evidence.
Make ownership explicit.
The complete guide includes topology choices, an identity ledger, five hosting contracts, an HTTP resource model, failure routing, security minimums, and fourteen acceptance tests.
Read the complete guide