Aloha -
I've gotten 'netmsg' to the point where files in the mounted, remote filesystem can be executed on the local machine. This isn't remote execution - it's just copying the files to the local machine and executing them there. Nothing more than what you'd expect from NFS or Samba, but it works.
'libpager', as we've discussed, can't handle multiple clients, and some extra effort is required to avoid this limitation. You need a custom exec server that doesn't attempt any mmap()'s. It's a simple patch, but not one we want in the mainline code, except perhaps for testing purposes. Anybody see any reason for a --no-mmap flag to the exec server?
Unfortunately, my patched exec server doesn't work as /hurd/exec. The system freezes right after the "Hurd server bootstrap" line, and I've spent the afternoon trying to figure out why. At first I thought it was a problem with my exec server executing shell scripts (runsystem.sysv, to be specific), but I now realize that this is a bug in the standard exec server executing shell scripts. I filed a bug report; it has to do with re-authentication, so I'd rather somebody else sign off on how to fix it.
In the mean time, I'm still wondering why an mmap-less exec server won't boot my Hurd.