Add cross-desk referral, and the federated benchmark that scored it

.github/workflows/ci.yml

@@ -60,6 +60,7 @@ jobs:
           cargo run -p tinyhivemind-core --example basic
           cargo run -p tinyhivemind-hive --example hive
           cargo run -p tinyhivemind-hive --example bench -- --episodes 25
+          cargo run -p tinyhivemind-hive --example bench -- --swarm --episodes 10
 
       # `tinyhivemind-core` is what a host links on the hot path of every agent
       # turn, in its default build. Keeping it free of runtimes and transports

AGENTS.md

@@ -168,9 +168,11 @@ Supporting commands:
 - `cargo run --release -p tinyhivemind-hive --example bench` — simulate and
   benchmark deliberation against the responder ladder and a matched-budget
   vote; `-- --sweep` tunes the episode policy, `-- --trace` prints one episode,
-  and `-- --agent-cmd "opencode run"` drives one through a real agent CLI. The
-  harness is documented in `crates/tinyhivemind-hive/examples/bench/README.md`
-  and its findings on the wiki's `Benchmarks` page (`wiki/Benchmarks.md`).
+  `-- --swarm` runs a federation of desks that can only reach each other by a
+  referral, and `-- --agent-cmd "opencode run"` drives one through a real agent
+  CLI. The harness is documented in
+  `crates/tinyhivemind-hive/examples/bench/README.md` and its findings on the
+  wiki's `Benchmarks` page (`wiki/Benchmarks.md`).
 - `.github/scripts/assert-pure.sh` — assert the pure crates took on no
   runtime, transport, or web-framework dependency.
 - `cargo doc --no-deps --all-features` — build the rustdoc CI also builds with

README.md

@@ -209,6 +209,32 @@ agent A's words as its own.
 One log, one sequence numbering, two histories. Every line a viewer did not
 write arrives as somebody else's, named.
 
+## A desk is a correlation boundary, so a question can leave it
+
+One room can pool what its members separately know. A *company* of rooms cannot,
+and that is not an inconvenience — it is the thing that decides the answer.
+Members of one desk read the same transcript, work the same part of the system,
+and are wrong about the same things. Averaging correlated error does not remove
+it, so no amount of deliberating inside a channel cancels a mistake every member
+of it shares.
+
+A **referral** is the one mechanism here that leaves a conversation: at most one
+turn, which may run on another desk, and one answer carried back to the
+conversation that asked. `@#platform` is not a broadcast — it resolves to
+exactly one agent before the decision leaves the fold — and a round trip is two
+hops, so it cannot ring.
+
+Three desks, each confidently wrong about a different option, deciding one
+question: deliberating inside the channels gets it right **0.2%** of the time,
+and every desk converges anyway, on three incompatible answers. Putting all
+twelve members in one room instead — removing the boundary rather than crossing
+it — gets **10.5%**, because a bigger room with three factions never reaches
+quorum. Crossing it gets **77.5%**, which matches what the same information is
+worth when handed over for free.
+
+It is off by default, and at desks with no blind spot of their own it changes
+no answer and costs twice the turns. That is the honest case for leaving it off.
+
 ## The window is a budget, so the transcript is queryable
 
 That projection is bounded — about thirty messages — and the log behind it is
@@ -349,7 +375,7 @@ They are enforced by the shape of the crates, not by discipline:
 ```
 
 Anything answerable from its arguments lives in a pure crate; anything that has
-to wait lives behind one of the three ports. CI asserts the split rather than
+to wait lives behind one of the ports. CI asserts the split rather than
 trusting it — the pure crates cannot take on a runtime, a transport, an HTTP
 client, a web framework or a database driver without failing the build.
 
@@ -437,11 +463,12 @@ see what the thing actually does.
 | [Architecture](https://github.com/tinyhumansai/tinyhivemind/wiki/Architecture) | the three crates and why they are split that way |
 | [Threads](https://github.com/tinyhumansai/tinyhivemind/wiki/Threads) | thread-scoped projection, and finding your way back into a busy desk |
 | [Recall](https://github.com/tinyhumansai/tinyhivemind/wiki/Recall) | searching the transcript, pinning what must not be lost, and the message budget |
+| [Cross-desk referral](https://github.com/tinyhumansai/tinyhivemind/wiki/Cross-desk-referral) | asking another channel a question, and getting the answer back |
 | [Hive episodes](https://github.com/tinyhumansai/tinyhivemind/wiki/Hive-episodes) | salience, quorum, cross-inhibition, and the attention market |
 | [Trace grammar](https://github.com/tinyhumansai/tinyhivemind/wiki/Trace-grammar) | what a marker deposits, and what real models get wrong |
 | [Episode policy](https://github.com/tinyhumansai/tinyhivemind/wiki/Episode-policy) | every setting, and how to tune it to the size of a desk |
 | [Benchmarks](https://github.com/tinyhumansai/tinyhivemind/wiki/Benchmarks) | the full report, including what it does not show |
-| [Host integration](https://github.com/tinyhumansai/tinyhivemind/wiki/Host-integration) | the three ports, and what your application owes the library |
+| [Host integration](https://github.com/tinyhumansai/tinyhivemind/wiki/Host-integration) | the ports, and what your application owes the library |
 | [Agent councils](https://github.com/tinyhumansai/tinyhivemind/wiki/Agent-councils) | how this differs from a council or crew, and what each does better |
 | [Development](https://github.com/tinyhumansai/tinyhivemind/wiki/Development) | the build contract, testing, and how to contribute |
 | [Glossary](https://github.com/tinyhumansai/tinyhivemind/wiki/Glossary) | every term, what it means here, and where it came from |

ROADMAP.md

@@ -25,8 +25,19 @@ dependency direction is enforced by construction.
 | P11 | `SessionMessage.parent` and the structured trace sidecar | planned |
 | P12 | Per-conversation read state | planned |
 | P13 | Digests and supersession | planned |
+| P15 | Cross-desk referral: one child turn that may run on another channel, the answer that comes back, and the federated benchmark that scored it | **done**, every knob **off by default** |
 | P14 | Recall: one selection ranking, roster and desk pickers, bounded transcript search with optional regular expressions, pinning as a fold, and a stated per-message budget | **done** |
 
+P15 is also out of order, and for a related reason: it is not a wire-format
+change either, and it answers a pressure none of P10 through P13 address. Every
+mechanism before it stops at the edge of one conversation, so a room of agents
+can pool what its members know and a *company* of them cannot. A desk is a
+correlation boundary — members of one desk are wrong about the same things —
+and no amount of deliberating inside a channel cancels an error every member
+shares. See [`docs/specs/cross-desk-referral.md`](docs/specs/cross-desk-referral.md),
+[ADR 0006](docs/adr/0006-a-referral-crosses-one-channel-at-a-time.md) and
+[the federated experiment](docs/experiments/2026-09-02-federated-hidden-profile.md).
+
 P14 is out of order on purpose. It is not a wire-format change and does not
 wait on P10 through P13: it answers the same pressure they do — a bounded
 window over an unbounded log — with the two mechanisms that need no new port

crates/tinyhivemind-core/src/lib.rs

@@ -47,6 +47,8 @@
 //! - [`error`] — typed failures from malformed records or unresolved desks.
 //! - [`find`] — name searches over a roster snapshot and a desk snapshot.
 //! - [`mention`] — authored mention parsing and pure routing choices.
+//! - [`referral`] — bounded selection of one child turn that may cross a desk,
+//!   and the one answer that comes back.
 //! - [`roster`] — borrowed agent and person identity snapshots.
 //! - [`responder`] — deterministic selection of one agent for one message.
 //! - [`select`] — the one ranking used by every picker in this workspace.
@@ -102,6 +104,7 @@ pub mod dispatch;
 pub mod error;
 pub mod find;
 pub mod mention;
+pub mod referral;
 pub mod responder;
 pub mod roster;
 pub mod select;