an auth/factotum is started by some initialisation code when you boot and log in to your terminal.
on the cpu server, the same is true for the host owner (the owner of the cpu service),
but then when you cpu(1) into a cpu server, your profile has a switch on the service environment variable,
which is "cpu" for an incoming cpu call:
h% cat $home/lib/profile
...
switch($service){
case terminal
...
case cpu
...
bind /mnt/term/mnt/factotum /mnt/factotum
...
}