Concept · Cluster · 4 min read

Lending models between machines

A desktop with a real GPU and a laptop that could never load a 12B model can behave like one system: the laptop borrows the desktop's models over your own tailnet, authenticated per-request, revocable in one click.

The idea

A borrowed model is an API-call replacement. It can also be the model that processes your images (the picture crosses the link once and the other machine describes it), and the model settings set on the lending machine, such as its context window, are followed on yours. The model picker shows the other machine's models grouped under that computer's name, and everywhere a local model works — chat, kapsules, delegation — the remote one works identically, streaming into the same bubble. Setup is one kcat_… connection code: How-To ▸ Lend models.

What crosses the wire — stated honestly

Compute crosses. Prompts cross — the lender's model must read your conversation to answer it; that's inherent, and it's the fact to weigh if the two machines are trusted differently. Authority never crosses: the request deliberately strips session keys, approval modes, and trusted scopes, so the lender can never act with the borrower's permissions — and the reverse token has no tool powers to offer.

The three-tier code

A connection code carries exactly one of three tiers: observe (see the model list), infer (run inference — the point of the mesh), admin (infer plus managing the lender's own grants). There is deliberately no tool tier: a kcat_ lends a model, a chynj_ access code signs in a person, and neither can impersonate the other.

The CLI-assistant exception

claude-cli and codex-cli are not plain models — they're agents with their own internal tool loops. Lend one and its work (file edits, commands) runs on the lending machine, directed by whoever holds the token. Kaptain tags them "runs work here" in the grant list and warns whenever a grant would include one. Lend them only to someone you'd let use that computer.

Where tools run for plain models

For every ordinary model — local, Ollama, GGUF, cloud — the tool loop belongs to the machine that owns the conversation. A borrowed model can ask for a file edit; the edit executes on your machine, in your project, through your approval gate. Remote GPU thinking, local hands.

Agent-readable version: index.md