Local and remote deployment Both modes use the same actor/learner protocol and durability; remote mode adds an encrypted tunnel becausethe bearer token does not encrypt traffic. Local train · one Windows host Remote actor · separate Trackmania host Shared learner runtime spawn rollouts CLI launcher multiprocessingspawn Actor process game · policy ·spool Learner process loopback gRPC Actor + spool stable actor ID SSH or VPN authenticatedencryption Loopbackport SSH/VPNforward Same run identity token · fingerprint ·map · contracts Coordinatorendpoint bounded authenticatedrequests WAL + appliedfrontier persist before ACK Replay + learner sample · update ·evaluate Portable outputs policy snapshot ·checkpoint Local does not mean in-process: actor and learner are separate spawn-safe processes, and failures mustpropagate to the launcher. Never expose gRPC directly. Keep the learner on literal loopback and carry it through an authenticatedencrypted tunnel.