Spike native shells and define local-first integrations

docs/PRODUCT_SPEC.md

@@ -21,6 +21,24 @@ The product should feel faster and calmer as concurrency rises.
 5. Review file and Git changes by workspace or worktree.
 6. Understand usage, rate-limit windows, burn rate, and likely exhaustion time.
 7. Resume the entire workspace after the UI or machine restarts.
+8. Work from a laptop while selected panes and agents run durably on a
+   user-owned machine reached through SSH or Tailscale.
+9. Follow a project's Buzz channel and intentionally share a redacted pane image
+   without leaving the workspace.
+
+## Local and remote workspaces
+
+Every Lumbridge installation is useful on its own and owns its local settings,
+history, usage observations, and workspace views. A pane can execute locally or
+on a saved remote host. Remote hosts may be normal SSH destinations, entries in
+the user's SSH config, Tailscale MagicDNS names, or tailnet IPs.
+
+For durable remote work, a per-user Lumbridge runtime on the destination owns
+the PTY and process tree. The desktop app connects to that runtime over an SSH
+stdio channel and can later reconnect without moving the process to a cloud
+service. The same remote workspace may be opened from another authorized
+Lumbridge installation, but local UI state is not silently merged between
+devices.
 
 ## Initial harnesses
 
@@ -64,13 +82,23 @@ harness-reported, locally measured, estimated, or unavailable. Lumbridge must
 not scrape browser cookies or reverse-engineer private account APIs to manufacture
 an exact remaining balance. When only local observations exist, the UI says so.
 
+## Buzz collaboration
+
+Buzz is optional and deeply integrated: an engineer can connect an existing
+identity, bind channels to workspaces, read and send messages, see channel
+agents, and share a pane image. Sharing always previews the exact capture,
+redactions, caption, and destination before upload. Buzz identity secrets stay
+in the operating-system credential store.
+
 ## Non-goals for the first release
 
 - A new foundation-model training or inference service.
 - A hosted account or mandatory Lumbridge cloud.
 - Replacing every coding harness with one Lumbridge-owned agent loop.
 - Windows support.
-- Mobile control, collaborative cloud sessions, or remote execution.
+- Mobile control or collaborative hosted sessions.
+- Arbitrary third-party remote compute provisioning; the first release connects
+  only to machines and SSH/Tailscale access the user already controls.
 - Bundling third-party subscriptions or reselling model tokens.
 
 ## Experience principles
@@ -81,4 +109,3 @@ an exact remaining balance. When only local observations exist, the UI says so.
 - Approval and security boundaries stay visible.
 - Local and offline workflows remain useful.
 - Estimates are useful only when their uncertainty is honest.
-