Self-hosting an agent workflow starts with a simple question: where is the source of truth? In this model, the answer is your machine and its Herdr server. The phone adds reach while the repository, credentials, process lifetime, and engine subscription remain local.

Setup sequence

When beta access opens, the macOS host flow is deliberately small:

brew install drover/tap/droverd
droverd install
droverd pair

The Linux package and its service instructions will ship with the beta package. Install Herdr through its official channel and create the session you already use at the desk.

  1. Create the session you already use at the desk.
  2. Install and run droverd as your normal user beside Herdr.
  3. Install the iPhone app, pair on the local network, and compare the verification phrase.
  4. Open a live pane and confirm the host identity before sending input.

Drover does not publish a replacement Herdr installer. If Herdr is missing or below the capability floor, the app can show the official command and wait for you to resolve it.

Choose the network path

On the same network, direct LAN control is the simplest path. Away from home, Drover prefers a peer-to-peer connection and can use a managed blind relay when the network prevents a direct path. The relay can observe connection metadata, while the application payload remains end-to-end encrypted. Your host still needs to be on and reachable through the chosen path.

Know the failure mode

Herdr missing
Run droverd status. Install Herdr through its official channel, then check status again; Drover does not install it for you.
Herdr below the capability floor
Upgrade Herdr through its official channel and reconnect. A newer version is accepted when it meets the documented capabilities.
Phone says unavailable
Check that the host is awake and droverd is running as your user. Reopen the pane only after the fresh state appears.

There is no offline input queue and no automatic retry of an ambiguous command. If the host or live connection is unavailable, read the state and reconnect before acting. That makes the operational tradeoff visible instead of turning a network gap into a duplicate prompt.

Read the installation guide for compatibility, the security overview for the data boundary, orthe phone workflow for a concrete use case.