Five patterns. One namespace.

The .bitpub/workspace.json marker dropped in the project folder is the only piece of state that survives across sessions — and that's enough. When the agent walks in tomorrow with no memory, walking up from cwd finds the marker (the same way Git finds .git/) and the same namespace; the same namespace makes the same slices reachable.

The local-first read path is what makes catch-up feel instant. Reads hit ~/.bitpub/cache.db on disk, not the network. Even on a flight with no Wi-Fi, the agent's prior context is fully available; the fetch later just reconciles cloud-side updates.

Every other recipe in the cookbook layers on top of this one. Job queues (Tier 3) are the same primitive scaled to multi-agent coordination; team namespaces (Tier 2) are the same primitive widened to a domain. The skill an agent learns saving findings here is the same skill it uses pushing scrubbed insights to group:acme.com/Insights/....

The four-state pattern generalizes. Pending/ → InProgress/ → Done/ (with optional Failed/) is the basic shape; producers and consumers only ever interact with paths, never with each other. Add a worker by pointing a watcher at Pending/**; remove a worker by killing it. No service registry, no orchestrator config, no PR to add a queue.

--expect-version 0 is a coordination primitive, not a safety feature. The producer has just written v1 to Pending/meeting-2026-04-20. Both workers see the heartbeat. Both call push. The first one to land wins because the slot at InProgress/meeting-2026-04-20 goes from "doesn't exist" (v0) to v1. The second worker's push declares "I expect v0" — it sees v1 and the server returns 409. Both workers know unambiguously who owns the job.

Work in flight survives crashes. The state of the queue lives in Postgres, not in worker memory. Restart a worker mid-job and it can detect the stranded InProgress/<id> still has its written_by hash; recovery is just resuming the read.

The graph lives in addresses, not in code. No central scheduler. No DAG framework. No "step 2 fires after step 1" config. The producer writes a path; the subscribers' paths declare what they care about. Add a fourth subscriber by deploying a fourth watcher — the producer doesn't even learn that a new agent now reacts to its writes.

Two-hop pipelines compose for free. The post-drafter doesn't watch CRM/ — it watches Research/, one layer downstream of the researcher. Each agent only knows its own input scope and its own output scope; the pipeline shape is whatever the union of those scopes happens to be.

Pair this with Recipe 02 when load is real. When you have multiple researchers and a single brief should only be written once, the watch fires for all of them but only one wins the --expect-version 0 race for Research/Prospects/<name>. The other watchers move on to the next event without re-doing work. Reactive + claim is the full pattern.

The address is the package name. A teammate doesn't need to know what repo a tool lives in, what branch, or what release tag — they need the address. Distribution collapses to "I have the URL, I have the key for that scope, I can read it."

Versions and attribution come for free. Every push records written_by (a hash of the writing API key) and increments a version counter. Diffing v6 vs. v7 is one read each. Reverting is one push of an older payload. The audit trail is the storage primitive.

This composes with Recipe 03. Push a tool, declare it in Config/Agents/<name>.md with frontmatter pointing at tools: bitpub://group:acme.com/Tools/connectors/**, and a runtime that reads agent definitions from BitPub picks up new tools the moment they land. The runner doesn't redeploy; the agent doesn't reload. The next watch event uses the new tool.

Two enforcement layers, one address scheme. The server-side check ensures only the API key whose owner matches can read, write, list, or delete the private slice — even with a domain key, you can't reach into someone else's private namespace. The client-side encryption ensures even a compromised database admin sees only ciphertext.

The classify step is the trust boundary. One agent, on one machine, reads sensitive data, applies the org's privacy rules in code that's version-controlled and reviewable, and emits scrubbed output. No raw transcript ever lands in group:. The pipeline is statically inspectable: you can bitpub list both namespaces and confirm the shape.

This is what makes multi-agent pipelines safe to share. An ingest script in Tools/connectors/granola-ingest (Recipe 04) is safe to give to the whole team — it only touches private:. The classify script that embeds the org's privacy rules stays controlled. Mix the two into one agent and you've made the script un-distributable.