Remote control with Cella Link

Current status: later planned remote-operator track.

Context, enrollment, and private transport

A Context selects a saved Installation. A Link is an authenticated operator connection to it. Local/admin-authorized pairing issues a distinct revocable device identity; its private key remains in the device keychain or secure hardware.

The remote CLI sends typed user intent only to the Installation's authoritative cellad. It receives no component sockets, runtime authority, provider credentials, Project Secrets, or direct Wall/Gateway/Relay/secret-boundary routes. Operator/device policy scopes Installations, repositories, Workstreams, Cells, methods, approvals, and administration.

Transport is mutual TLS over a configured user-provided private route: LAN, VPN, overlay network, or equivalent. Link requires no Cloud account, Cloud control plane, hosted relay, or external Cella service. It is not raw SSH, remote desktop, a generic tunnel, or general host control.

Multiple operators and attributable decisions

Multiple enrolled operators may observe the same Workstream. Mutations include an expected state version and are serialized by cellad; conflicts fail explicitly. Interactive input normally uses one renewable lease; others observe until policy transfers or shares control.

Approval binds exact request digest, rule, Installation, operator, device, decision, timestamp, and expiry. Policy may require distinct approvers/roles. Disconnect, retry, and failover never duplicate a consequence. Evidence records pairing, authentication, requests, conflicts, lease changes, approvals, revocation, transport path, and bounded outcomes without secret values or private keys.

Example: an enrolled Mac controls work on a Debian Installation through cellad; a revoked or wrong-Installation device is refused. Start, observe, attach, pause, resume, approve, and inspect all retain the same authority chain.

See remote-operator requirement and Link control flow.