DL-316

Server↔Runner transport is TWO-PLANE (amends DL-013’s Runner↔Server clause, RIG-2861 OQ-5 Variant B): async command-push + Runner event fan-in ride NATS (per-Runner command subjects + queue-group fan-in — Sessions/PublishEvents reshaped to pub/sub for the non-sticky-wake fabric); the typed request/reply legs (enrollment, unary Relay*Calls/CommitConversationFrame/FetchSecrets, bulk FetchAgentConfig) stay on the reduced Connect/gRPC edge (deadline propagation, typed proto errors, generated stubs); the per-Runner provisioned token is retained as the NATS-credentials seed via auth-callout. Client↔Server stays Connect; Runner↔Agent stays vsock. Supersedes DL-013

Status: Active (Matt, 2026-08-31)

Record: ../../infra/runtime/compass-managed-multitenancy/design.md#resolved-decisions-freeze–matt-2026-08-31