A Grok-Native Median Session Plane

Alex Price (StellarRequiem) · 2026-08-06 · security@xclusivexo.com · companion to Authority Is Not Ambient

CLAIM BOUNDARY Architecture and operator-verified local stack. Not enterprise SOC, not ambient phone RPA, not free shell from Connectors, not a model leaderboard claim. Public wording ≤ evidence. arXiv submission package prepared (cs.CR); ID will appear here after announcement.

Full Markdown arXiv LaTeX source arXiv submit checklist Release notes (narrative) Host control plane paper MCP assurance

Abstract

Frontier chat and local agent runtimes have diverged. Operators want one reasoning surface—here, Grok—while high-privilege execution belongs on a mediated host control plane. This paper specifies a median session plane: a shared, append-only session between a full host actor (Grok Build under agent-control, leashes, and mcp-assure) and light remote clients (Safari on a private path; Grok chat via public HTTPS MCP Connectors). Device bind, TOTP and security-mailbox enroll, plain-English routing onto allowlisted host skills, and an explicit claim ceiling keep the phone from becoming ambient OS control. The design is a stepping stone to a host task runner that accepts free-text remote work without free shell.

Thesis

Full agent authority stays on the host under deny-by-default mediation. Remote clients share a median session—intent, status skills, and notes—not ambient OS control.

Two planes, one session

FULL AGENT PLANE (Mac) Grok Build → agent-control → browser-leash / desktop-leash + mcp-assure + agent-soc FREEZE MEDIAN SESSION PLANE (session-bus) events · arm · skill bind · device bind · allowlisted skills LIGHT REMOTE Safari UI (Tailscale) Grok chat MCP (public tunnel) device cookie + TOTP session_work → same-turn status

Crown jewel pairing

Authority Is Not Ambient

Host control plane: mcp-assure, leashes, AdaptiveGate, FREEZE. The systems foundation.

Grok control plane · release notes

Fact-driven public narrative: why Grok-first, how pieces connect, what is not claimed.

Contributions

Median session architecture for dual-actor (host full + remote light) operation.
Grok-native product path: Build for execution; Connectors MCP for remote light tools; Skills for steering.
Remote posture: tunnel auth, device bind, challenges, TOTP, optional security@ SMTP.
session_work: plain English → allowlisted skills; unmatched text → notes for host Build.
Publishable claim ceiling and roadmap to a host task runner without free shell.

What we do not claim

Grok iOS is a full computer-use agent or native skill host.
Ambient reverse shell or unmediated shell over the tunnel.
Enterprise IdP / FIDO / continuous SOC.
Model leaderboard superiority over other frontiers.
session-bus as multi-tenant SaaS (operator median plane).

Next stepping stone

Priority	Deliverable	Unlocks
P0	`session_task` + host task runner	Phone free text → allowlisted Build work
P1	High-blast confirm channel	Safer expansion of remote intent
P2	Stable named tunnel	Fewer reconnects
P3	AdaptiveGate budgets on bus tasks	Same doctrine as leashes

Public-safe design stubs (not secrets)

Real operator defaults and fixture shapes used in evaluation. Live tunnel hostnames, bus tokens, TOTP seeds, and pairing codes are never published.

Parameter	Stub / shape
Bus / MCP ports	`8758` UI · `8760` MCP (local; tunnel for Connectors)
Leash ports	browser `8756` · desktop `8757`
Tunnel URL shape	`https://<ephemeral-host>.example-tunnel/mcp`
Session id fixture	`00000000-0000-4000-8000-000000000001`
Allowlisted skills	`plane.status`, `bus.status`, `git_status`, `host.whoami`, `session.info`, `disk.free`
NL stubs	`"how's the host"` → `host.whoami`; `"git status on portfolio"` → `git_status`
OAuth client id	`session-bus` (not a secret); client secret = bus token (redacted)
Enroll contact	`security@xclusivexo.com` (public); mailbox password never published
Device cookie name	`session_bus_device` (HttpOnly; value opaque)

{ "kind": "skill_result", "skill": "host.whoami", "input": "how's the host", "session_id": "00000000-0000-4000-8000-000000000001", "result": {"user": "operator", "host": "example-host", "plane": "full"} }

Full text

Complete working paper (Markdown): 2026-08-grok-native-median-session-plane.md — includes fixture JSON for tools/list, matched skill, note-post, and OAuth token shape.

Evaluation classes: unit tests, MCP smokes, live Connectors Connected, SMTP enroll when configured, public OSS control-plane repos—not unmeasured detection rates.