Seiji Nakaya

Spot on, and that identity layer is exactly the bet behind Vibsync, the MCP coordination layer this post is describing. Every data-plane call carries an Ed25519-signed token, and attribution is read from its claims rather than the client's word, so an agent can't spoof who it is. OAuth grants (Claude Code) are attributable to a specific person and device and revocable per device; machine tokens (CI) carry the account only and are recorded as a weaker signal instead of being silently treated as equal. Each credential is scoped to exactly one team, so a decommissioned agent is killed by revoking its credential and can't reach another team's store at all and every mutation lands in a per-team, hash-chained audit log keyed to that attested actor. One honest note since you care about the semantics: the file claims are advisory coordination locks, not a distributed mutex, a cooperative signal that stops two agents unknowingly stomping the same file, not a hard lock. Appreciate you drawing out the identity angle; it's the part most MCP-memory writeups skip.