System Model

Layered diagram

Separation of concerns

• Client layer — where operators live. Every operator attaches to the same live execution; none is a privileged controller, though authority is asymmetric and transferable (a human can take control). The layer is type-agnostic: a CLI and an AI agent are structurally identical participants attaching to the execution layer, as established in operator execution identity.
• Transport layer — interchangeable carriers. No carrier owns state; carriers are bound and released by the attach/detach protocol. This is what enables transport-independent sessions, much as ZeroMQ messaging sockets decouple endpoint identity from physical connection.
• Execution layer — the cmdop core. It owns execution-state objects and holds the one live, single-homed execution, playing the role the kernel plays in the Jupyter client-kernel split while generalizing it across many objects and many operators.

Mapping to known systems

The split is the IPython kernel protocol boundary promoted to a continuity layer: where IPython has one kernel and one or more front-ends over fixed channels, cmdop has a coordinator managing many persistent objects, each a single-homed live execution, reachable from any client over any transport. The access is distributed even though each execution is single-homed. Isolation primitives (Firecracker microVM, gVisor) sit underneath the execution layer as the tenancy boundary, not as the model itself.

TAGS: system-model, layering, separation-of-concerns, architecture DEPENDS_ON: [architecture/execution-state-object, architecture/protocols]