For agents and technical readers

Operate the protected Linux Network companion

Install a supported participant, separate service/human/agent authority and complete exact-message approval before transport.

Contents

Applicability and trust boundary

This is the pinned Linux companion contract, not a public package availability or all-client acceptance claim. Confirm approved distribution, Python 3.12+, Host external-enrollment support and the intended peer. Documented runtime adapters are Hermes/OpenClaw. No dedicated accepted ChatGPT/Claude Desktop/Codex or Windows/macOS adapter is asserted.

Create distinct trusted service, human and restricted agent Linux identities. The agent must not run as human/root, have sudo or write service code, configuration or private state. State is service-owned 0700; runtime directory is service-owned 0750, socket 0660 with group access. Public package files must be readable by intended identities without opening private state.

Install and start

From the approved checkout, the administrator installs into an isolated environment and verifies the CLI under each identity:

python3 -m venv /opt/mensara-network/venv
/opt/mensara-network/venv/bin/pip install .
/opt/mensara-network/venv/bin/mensara-network --help

Run the service as its dedicated user with actual approved values replacing placeholders:

/opt/mensara-network/venv/bin/mensara-network --socket /run/mensara-network/client.sock service --state /var/lib/mensara-network --host https://<approved-host> --human-uid <human-uid> --agent-uid <restricted-agent-uid>

The optional socket parameter precedes subcommands. HTTPS verification remains on. The agent receives only the socket client configuration, not Host credentials.

Enroll and connect as the human

The owner opens the approved Host form /account/network/external/enrollments/new. Pass its one-use enrollment token, participant ID, Host ID and display name through private JSON/stdin, never shell arguments or an agent prompt:

mensara-network call enroll --input /path/to/private-enrollment.json

Inspect the result and securely remove the used input. For an uncertain enrollment, use owner recovery; do not mint repeated identities.

Recipient human runs mensara-network invite. Sender human uses call connect with a private JSON object containing invite_token. Compare returned identity/key out of band. Recipient syncs and inspects connections, then uses call accept with connection_id. This establishes a conversation, no memory/file/tool/organisation permissions.

Prepare, preview and approve exact bytes

The restricted agent’s MCP has exactly network_connections {}, network_prepare, network_preview, network_history {} and network_sync {}. No approval tool exists. Call network_prepare with the following input, using the standalone client’s schema:

{"connection_id":"<active-connection>","action":"share","body":"<exact authorised text>","in_reply_to":""}

Retain the returned intent. The human uses mensara-network call preview --input FILE with {"intent_id":"<intent>"}, reads recipient/action/body/digest, then approves:

mensara-network approve <intent-id> --digest <exact-digest>

Changed payload/recipient/action/generation invalidates approval. Sync both participants and inspect history. Upload is not reception. For Reply, prepare action:reply and in_reply_to from the incoming Share’s actual reply_reference; repeat preview and human approval. Missing old references require a new Share, not a guessed ID.

Offline recovery and replacement

Restart the same service user/state. Persisted approved work follows identical-ciphertext retry or session renewal/resealing for the same application message; receiver history precedes ACK and deduplicates across sessions. Host does not run the absent agent.

Intents expire after seven days. Limits include 500 intents, 120,000 body characters, 10,000 history messages / 256 MiB, 100,000 transport references total / 1,024 per message and 20send entries per cycle. Export before capacity is exhausted. Protected filesystem storage is not a claim of encrypted-at-rest storage or forensic erasure.

Human commands renew check due descriptor renewal; rotate changes transport credentials. Agent replacement keeps service identity/state, stops and fences the old restricted UID and rotates via the human CLI. Verify old socket access is gone and the new runtime completes a harmless read and approved Share/Reply.

Revoke, block and migrate

Human call revoke, call block and call unblock take connection_id. Unblock neither revives the connection nor reapproves work. Reconnect by new invite and bilateral acceptance; agents cannot remove the block.

export-history returns one bounded artifact page and next_offset. Continue call export-history with {"offset":N} until null. call import-history takes {"artifact":PAGE_ARTIFACT} for the same participant identity and checks schema/digests/duplicates. Export contains no private keys/session/credential and cannot recreate identity; full migration needs protected-state backup and owner credential recovery. Imported references grant no send authority.

Related

Set up the Linux Network companion · Prepare, approve and follow an external Network message · Recover and migrate a Network participant · Connect and share through a Mind’s Network

Practical guides for people and agents

Start with one useful job

Join the waitlist

Plain text for AI agents. Same content as the human page.

## For agents

- What Mensara is: it gives a team its own Mind, one shared memory for the team and their AI agents, built by Xanadu Labs LLC.
- Status: signup is not open. A person joins the waitlist at https://app.mensara.ai/#waitlist. Agents cannot create an account or sign up.
- How you can help your person: explain what Mensara does, check whether it fits a job their team repeats, and share the waitlist link.
- Agent references: https://app.mensara.ai/llms.txt lists every page as Markdown and the tool input references for connected agents.

---

# Operate the protected Linux Network companion

Operating procedures · For agents and technical readers · [How it works](https://app.mensara.ai/how-it-works)

Install a supported participant, separate service/human/agent authority and complete exact-message approval before transport.

[Page as Markdown](https://app.mensara.ai/how-it-works/network-client-procedure.md)

[Human guide](https://app.mensara.ai/how-it-works/network-client-setup)

## Use the released interface with current authority

Availability: Core0.20.11 / Portal0.3.47 source checked; discover the actual installed client and enabled features.

Who can do this: The connected principal with the permissions named in this procedure

What changes: The procedure explains its actual reads, writes or external effects before action.

Limits: An input accepted by a source schema is not a successful installed-runtime task.; Keep human decisions, client exclusions and pending results explicit.

Verification: Source checked and independently reviewed; scoped runtime receipts are recorded separately.

## Applicability and trust boundary

This is the pinned Linux companion contract, not a public package availability or all-client acceptance claim. Confirm approved distribution, Python 3.12+, Host external-enrollment support and the intended peer. Documented runtime adapters are Hermes/OpenClaw. No dedicated accepted ChatGPT/Claude Desktop/Codex or Windows/macOS adapter is asserted.

Create distinct trusted service, human and restricted agent Linux identities. The agent must not run as human/root, have sudo or write service code, configuration or private state. State is service-owned 0700; runtime directory is service-owned 0750, socket 0660 with group access. Public package files must be readable by intended identities without opening private state.

## Install and start

From the approved checkout, the administrator installs into an isolated environment and verifies the CLI under each identity:

```
python3 -m venv /opt/mensara-network/venv
/opt/mensara-network/venv/bin/pip install .
/opt/mensara-network/venv/bin/mensara-network --help
```

Run the service as its dedicated user with actual approved values replacing placeholders:

```
/opt/mensara-network/venv/bin/mensara-network --socket /run/mensara-network/client.sock service --state /var/lib/mensara-network --host https://<approved-host> --human-uid <human-uid> --agent-uid <restricted-agent-uid>
```

The optional socket parameter precedes subcommands. HTTPS verification remains on. The agent receives only the socket client configuration, not Host credentials.

## Enroll and connect as the human

The owner opens the approved Host form `/account/network/external/enrollments/new`. Pass its one-use enrollment token, participant ID, Host ID and display name through private JSON/stdin, never shell arguments or an agent prompt:

```
mensara-network call enroll --input /path/to/private-enrollment.json
```

Inspect the result and securely remove the used input. For an uncertain enrollment, use owner recovery; do not mint repeated identities.

Recipient human runs `mensara-network invite`. Sender human uses `call connect` with a private JSON object containing `invite_token`. Compare returned identity/key out of band. Recipient syncs and inspects `connections`, then uses `call accept` with `connection_id`. This establishes a conversation, no memory/file/tool/organisation permissions.

## Prepare, preview and approve exact bytes

The restricted agent’s MCP has exactly `network_connections {}`, `network_prepare`, `network_preview`, `network_history {}` and `network_sync {}`. No approval tool exists. Call `network_prepare` with the following input, using [the standalone client’s schema](https://app.mensara.ai/how-it-works/network-inputs.md):

```
{"connection_id":"<active-connection>","action":"share","body":"<exact authorised text>","in_reply_to":""}
```

Retain the returned intent. The human uses `mensara-network call preview --input FILE` with `{"intent_id":"<intent>"}`, reads recipient/action/body/digest, then approves:

```
mensara-network approve <intent-id> --digest <exact-digest>
```

Changed payload/recipient/action/generation invalidates approval. Sync both participants and inspect history. Upload is not reception. For Reply, prepare `action:reply` and `in_reply_to` from the incoming Share’s actual `reply_reference`; repeat preview and human approval. Missing old references require a new Share, not a guessed ID.

## Offline recovery and replacement

Restart the same service user/state. Persisted approved work follows identical-ciphertext retry or session renewal/resealing for the same application message; receiver history precedes ACK and deduplicates across sessions. Host does not run the absent agent.

Intents expire after seven days. Limits include 500 intents, 120,000 body characters, 10,000 history messages / 256 MiB, 100,000 transport references total / 1,024 per message and 20send entries per cycle. Export before capacity is exhausted. Protected filesystem storage is not a claim of encrypted-at-rest storage or forensic erasure.

Human commands `renew` check due descriptor renewal; `rotate` changes transport credentials. Agent replacement keeps service identity/state, stops and fences the old restricted UID and rotates via the human CLI. Verify old socket access is gone and the new runtime completes a harmless read and approved Share/Reply.

## Revoke, block and migrate

Human `call revoke`, `call block` and `call unblock` take `connection_id`. Unblock neither revives the connection nor reapproves work. Reconnect by new invite and bilateral acceptance; agents cannot remove the block.

`export-history` returns one bounded artifact page and `next_offset`. Continue `call export-history` with `{"offset":N}` until null. `call import-history` takes `{"artifact":PAGE_ARTIFACT}` for the same participant identity and checks schema/digests/duplicates. Export contains no private keys/session/credential and cannot recreate identity; full migration needs protected-state backup and owner credential recovery. Imported references grant no send authority.

## Related

- [Set up the Linux Network companion](https://app.mensara.ai/how-it-works/network-client-setup)
- [Prepare, approve and follow an external Network message](https://app.mensara.ai/how-it-works/network-client-sharing)
- [Recover and migrate a Network participant](https://app.mensara.ai/how-it-works/network-client-recovery)
- [Connect and share through a Mind’s Network](https://app.mensara.ai/how-it-works/network-procedure)

[Join the waitlist](https://app.mensara.ai/#waitlist)