# 0003: Data is local; remote sessions live on the user's remote machine

Status: accepted for implementation.

Each Lumbridge installation owns a local SQLite database and content-addressed
data directory. There is no mandatory Lumbridge account, hosted database, or
silent multi-device synchronization. Credentials remain in platform credential
stores, SSH agents, or upstream harnesses rather than SQLite.

Lumbridge supports local work and user-owned remote machines as equal execution
targets. OpenSSH is the default transport and may reach a Tailscale MagicDNS name
or tailnet address. An explicit `tailscale ssh` transport is also supported.
Lumbridge consumes existing connectivity and authorization; it does not manage
tailnet ACLs or private keys.

Durability belongs where the process runs. A remote per-user Lumbridge runtime
owns remote PTYs, agents, worktrees, event history, and scrollback. Desktop apps
connect over a framed SSH stdio stream and reconnect by stable session ID. This
allows a MacBook to close or change networks without terminating work on metal
or amd-server.

Another authorized Lumbridge installation may discover and attach to that remote
workspace. Its device-local window layout and preferences remain local. The
remote runtime arbitrates a single input owner in the first release; real-time
collaborative editing is a separate future capability.