Federation, Bureau, Embassy, and City

These four concepts have independent responsibilities:

• Federation is the authority backend and trust root. It owns accounts, Bureau records, Services, model catalogs, usage, env, and Token issuance.
• Bureau is a product or business partition inside Federation. A Bureau Token identifies a trusted product backend.
• Embassy is the window through which users and administrators access Federation. It has only user and admin identity domains.
• City is the Agent runtime container from @downcity/agent. It owns Workspaces and can hold an Embassy service client. It is not a Federation client or a registered Federation identity.

import { Embassy, Federation } from "@downcity/federation";
import { City } from "@downcity/agent";

const federation = new Federation({ database });
const embassy = new Embassy({ federation_url: "https://fed.example.com" });
const city = new City({ embassy, workspaces: [workspace] });
const agent = new Agent({ id: "assistant" });
city.agents.add(agent);

Identity boundaries

User Token, Admin Session Token, and Bureau Token are not interchangeable:

• embassy.user holds or obtains a User Token.
• embassy.admin holds or obtains an Admin Session Token.
• new Bureau({ bureau_token }) holds a long-lived Bureau machine credential.
• City does not become one of those identities. An Agent running inside City may use an Embassy or another client as an ordinary dependency.

CLI mapping

• fed / downfed deploys and manages Federation.
• city / downcity manages the local Agent host.

The two commands may share one distribution, but they own different runtimes and lifecycle state.