Embed the runtime

Use the server when you want a process to talk to. Use the crate when another Rust service already owns startup, configuration, and deployment, and you want sessions inside it.

let kernel = brain::Kernel::open(
    brain::KernelConfig {
        data_dir,
        max_decisions_per_turn: 128,
        loop_executor,
        model_executor,
        tool_executor,
    },
    telemetry,
)?;

// Admitting the request bounds its authority before anything is journalled.
let creating = kernel.begin_session(&resolved_session_request)?;

// Attach the Environments the request named, then seal what was actually granted.
let session = creating.complete(sealed_session_config)?;

session
    .message(brain_protocol::MessageRequest {
        content: serde_json::json!("Explain the current changes."),
    })
    .await?;

You supply the ports

loop_executor, model_executor, and tool_executor are the same seams the server fills in. Fill them differently and you get a different deployment without forking the runtime: your own storage, your own transport, your own placement.

What the runtime keeps

Writes still land before effects, and recovery still works the same way. The runtime does not become more permissive because it is embedded: begin_session and complete are the only ways a session is admitted, and both hold the request to the same contract the server's callers meet.

What stays yours

When a session is admitted, when it is resident, when it is recovered, when it is evicted. Where environments live and how they are found. Everything about product policy. The runtime has opinions about correctness, not about your architecture.

Telemetry delivery

The telemetry channel is bounded and never holds up a turn. Its worker drains queued records into ordered batches and retries a rejected batch for up to 30 seconds. A sink may therefore receive a batch more than once and must make duplicates harmless. Exhausted deliveries are counted and reported through telemetry_delivery_dropped records when the queue still has room.

Telemetry remains best effort. For resumable event forwarding, consume the session event endpoint, save its sequence cursor after the destination acknowledges a batch, and reconnect from that cursor. The journal, rather than the telemetry queue, is the durable record.