Over plain JSON

RemoteServer.answer(handlers, body) answers one request as Remote.http and Remote.json send it, whatever received it: an HTTP route, a worker, a server running in the page. It decodes the request and its payload by the protocol's own schemas before a handler sees them, so an operation is one of Remote's three and nothing else, and says what to send:

// A fetch-style route (Bun, Deno, a Worker; Node through its own adapter).
const route = async (request: Request): Promise<Response> => {
  const body: unknown = await request.json().catch(() => null)
  const answered = await Effect.runPromise(RemoteServer.answer(handlers, body))
  return Response.json(answered.body, { status: answered.status })
}

• 200 with { result }: the handler answered.
• 400 with { error }: the body is not a request, names an operation Remote does not have, or its payload fails the protocol's schema. No handler ran.
• 401 with { error, unauthenticated: { reason? } }: a handler could not tell who is asking (RemoteServer.unauthenticated). The client fails the call, of whatever kind, with _tag: 'Unauthenticated'.
• 403 with { error, forbidden: { reason? } }: who is asking may not do this (RemoteServer.forbid).
• 422 with { error, refusal }: the mutation refused what was asked, in its own Refusal.
• 500 with { error }: the handler failed, and the message is its own; or something on this side broke, and the message is Internal error, nothing more.

It binds no principal: pass the handlers for the request's own, established by your authentication, as everywhere else. It carries no live data.