[zts212653]

A standalone Collective installation previously started only the API, without its Client or attachment owner; the Host plugin always started an embedded Service. This adds the supported clowder-collective-service bin and an explicit remote Connector mode so a private SSH server can host the Service, same-version Client and durable ordinary attachments while each member keeps their own Café.

The Service retains its instance, provider state, bootstrap credential and immutable attachment receipts across restart and stopped backup/restore. Canonical browser origins support a different SSH-facing port without widening origin checks. Original shared Works remain with their Café content owner over the existing relay. Remote mode preserves embedded data and existing authority, reports outages and instance mismatch, and does not start a local listener.

alpha.16 includes pinned dependencies, installation/upgrade/recovery documentation, optional explicitly configured local ASR, and systemd examples. The Client retains source 5f055fcc907a67f015bceb84500256d8ad41e65d with 542 verified inputs. Host Contract 0.3.0 / SDK 0.3.0-beta.1 and Core remote-entry merge 64019020ac268cb3695a1b9025dfad1cc5a104c8 are the compatible integration cut.

Validation: package typecheck; lifecycle/remote/owner control and transport checks; business and attachment tests; real image/audio/video decoding; two clean package installations executing the actual bin and four standalone recovery checks each; retained Client provenance checks. Isolated OpenSSH browser journeys cover canonical Manifest URLs, two member contexts, images/files/audio/stickers, module pairing, original Work read/propose/adopt, and one-event recovery after an accepted response is dropped. Provider identities are fixtures; real cloud/two-computer/two-Human/GitHub acceptance remains the later deployment window. Evidence and reproduction commands: https://github.com/zts212653/cat-cafe/tree/main/docs/evidence/2026-10-27-f290-private-ssh-deployment

Release ordering is resolved: alpha.15 live catalog PR #143 merged as 4a01f85fc883a1f9953ba96731da1e2197bf2a63, and its owner released the shared writer. This PR preserves that live catalog and all historical rows, adding only the alpha.16 candidate. The #137 main integration is retained; Collective still installs published Contract 0.3.0 / SDK 0.3.0-beta.1, not the newer workspace candidates. A reproduced materializer bug installed candidate bytes under a frozen lock; exact local archive identity now gates substitution, with a red/green regression and actual installed-version assertions. The archive-verifier suite passes 29 checks and both clean installation paths pass four standalone checks each. The canonical bin is executable 0755.

Independent local review and fresh CI are required before merge; this PR does not claim an official alpha.16 package yet. Alpha installation of the merged package follows publication using this task's original instance. The final package includes explicit systemd daemon-reload and restore-to-a-new-directory commands. Global activation of unrelated candidate cohorts is outside this change.

[zts212653]

CI run 40497353782 passed the Collective behavior suite (424 passed; one ffmpeg-dependent media check explicitly skipped on the runner). It stopped at package-inventory because the retained candidate catalog still names alpha.15 while this PR prepares alpha.16. The catalog remains deliberately unchanged until the preceding alpha.15 live cut (#143) is released by its owner; that dependency is being resolved before this PR becomes merge-ready. No check is waived.

The canonical bin archive check separately exposed a 0644 entry that ordinary npm installation had made executable. Commit 32d4229b22307927e89b5545c5b5c253477805f4 uses the repository's existing package-bins.mjs build normalization. The same canonical pack command now passes with 0755. The resulting physical offline closure also passed all four real standalone startup/recovery checks.

[zts212653]

Independent local review is approved for exact HEAD a8e96067f1afb47307a02acc519f2bc34680a071: reviewer codex61-sol, author codex-astra, 0 P0/P1/P2, no open items. Durable fact: local-review:0001793117038841-001892-54e372a3:approved in thread_mvqgn68h22c18bl2. This replaces the canceled plugin-side Argon review; the separate Core approval remains historical.

Accepted source: docs/features/F290-ai-native-collective.md at 018f96bde7ba3c76ede981d61fdad0dc5d0fe80f, freshly rechecked unchanged. The accepted deployment plan remains the scoped engineering result; real cloud/two-computer/two-Human/GitHub and Linux systemd acceptance stay explicit and do not close F290.

Evidence validation E1–E5 passed: local and PR HEAD match; review covers exact HEAD without post-review source changes; typed provenance and accepted source match; approved with no unresolved findings; Contract CI 40501069712 and Personal Chrome CI 40501068582 both succeeded. Local git diff --check is clean. No additional cloud source was selected: the explicitly selected independent peer covered the whole deployment change and its data/authentication/recovery risks with actual installed-package and process checks.

Risk: behavior changes standalone/remote lifecycle; durable data changes ordinary attachment custody; security preserves current authority and exact origins; contracts add the supported bin/settings/status; immutable npm publication follows the verified source. No delete/migration, temporary workaround or production runtime restart. headChangeCause=pr-meta, nextGateOwner=author, stale=false, gate_passed=true, verdict=passed. The five-file music-only base advance has no intersection with the Collective change or changed packaging logic; reviewed author HEAD is unchanged.

Reviewer independently reran build/typecheck, lifecycle 12, scoped attachment/HTTP/sticker 19, archive helper 29, source 4, and both clean installations with four standalone checks each. Installed dependencies remain Contract 0.3.0 / SDK 0.3.0-beta.1. The canonical archive matches the reviewed build byte-for-byte, SHA256 df0feba352077af79ca2ffd213d91d11d63e4c67761ec022368e26de84c2d49d, bin 0755. Author OpenSSH/dual-context/Works-relay/lost-response evidence is in the linked Core evidence directory; its fixture and later-deployment limits remain stated.

Reviewer worktree disposition is released/removed, source pr:zts212653/clowder-ai-plugins#144; archive receipt 1e0f3320-0de9-46cf-8282-f06a7a9728ff. Author worktree remains needed for official package verification and the already authorized same-Alpha acceptance, then will be released. Merge is not a release or runtime-activation claim; only this package's catalog row will be activated after official registry verification.