You answered the archive card from the sofa. The laptop in the other room is where the task-tracker code lives, where the session ran, and where your answer was recorded. The phone showed you the question and carried your tap back; it never held the work.

That is the device model in one scene, and it needs three plain words before the rest of the section can use them.

  • A device is a machine that does the coding work. It runs the coding agent, keeps its own record, and answers to nobody else's copy of it.
  • A surface is a window onto one device's record. The desktop app is a surface. The phone is a surface. Neither is a second device, and neither is a second source of truth.
  • Your private mesh is your own machines networked privately to each other, which ROOK does through Tailscale. Your fleet is the set of work devices on it. The one you are looking at is that surface's origin device.

Which machine is the authority

Say you are out and want to know whether the search-shortcut work is still moving.

By hand, you would reach the machine itself: open a terminal on it, or leave a session running where you can see it later, or wait until you are back at the desk. With one machine in one room that is genuinely fine. Most days you know which laptop the work is on because there is only one.

It stops being fine when the answer has to come to you. A terminal is not a thing you can check usefully from a phone, and once there are two machines, "which laptop was that on" becomes a question you answer from memory. ROOK's split is that the machine keeps being the authority while a window comes to you. The phone selects one origin device, reads what that device recorded, and shows the card. Your answer goes back to that device's record, not into a phone-side history that would later have to be reconciled with it.

Reaching the machine
  • Open a terminal on it, or leave a session running where you can see it later
  • Genuinely fine with one machine in one room
  • Once there are two, which laptop was that on is answered from memory
  • A terminal is not a thing you check usefully from a phone
A window onto the machine
  • The surface selects one origin device and reads what that device recorded
  • Your answer goes back to that device's record
  • Each device owns its record, so two machines never have to agree about a shared one
  • Unreachable means it says so, not a best guess from an older copy
Checking on work running elsewhere. Both routes end at the same machine; only one of them lets the answer come to you.

The limit is worth naming immediately: a surface can only show what its selected origin currently exposes. If a device is unreachable, the honest answer is that you cannot see it right now, not a best guess assembled from an older copy.

Writes go home

An answer needs a live path to the origin device. When that path is down, a surface goes read-only and says so, instead of holding your tap and replaying it later into a record that has moved on. A held answer would be the more comfortable behavior and the less honest one: you would believe the archive decision was made, and the session waiting on it would not have heard.

The same rule is what keeps the fleet simple. Each device owns its own record, so two machines never have to agree about a shared one.

What this still depends on

The authoritative ROOK record stays on the device doing the work, and surfaces read it directly over your private mesh. ROOK does run a server process, but it runs on each work machine beside the record it serves; there is no central ROOK service holding your project state, and none of it is hosted by us. Two external dependencies are real: the coding agent calls a model provider over the internet, and device identity and connectivity depend on Tailscale's coordination service.

Keeping those two named beside the local-record claim is deliberate. The record is local; the system around it is not free of outside services.

This section

PageWhat it explains
The device modelOrigin device, fleet and surface, and where identity comes from
Device controlWhat live, stale, draining and stopped mean, and how to stop work safely

Limits

This model explains ownership and connection between the parts that exist today. It is not a claim that ROOK runs on every platform, and it is not a claim that another person can install it. Both of those questions belong to status and limits.

Next

Start with the vocabulary the rest of the section leans on: the device model.