System design

How the architecture holds its boundary

A production system is defined by what it refuses as much as what it accepts. Keep the browser workflow central while execution, credentials, repositories, and process authority stay at the selected node.

Control planes

Supervised node

A per-user daemon owns device authentication, supervision, local policy, and the outbound tunnel.

Typed WSS broker

The broker multiplexes typed control, terminal, diff, and decision frames; it is not a generic TCP proxy.

Detached workspaces

Every repository task receives a detached Git worktree; non-repository work receives a private scratch space.

Request lifecycle

authenticated CLI or browser request
  → typed broker envelope
  → target-owned policy decision
  → detached Git worktree or scratch space
  → bounded process and tmux session
  → sequenced events and reviewed receipt

Failure model

Malformed, stale, oversized, unauthorized, or out-of-sequence requests are rejected before they reach a workspace; recovery is idempotent and bounded.

Verification checklist

Default deny: Cloud input never grants filesystem or executable authority.
No inbound node port: The node opens no Bernato inbound port; the local IDE binds numeric loopback only.
Bounded execution: Subprocesses have explicit executables, bounded lifecycles, and fail-closed admission.
Non-executable memory: Git-tracked Markdown is untrusted reference material and never executable instruction.

← Back to overview