Architecture · Published 26 August 2026
Designing an outbound-only control plane for distributed coding agents
A boundary-by-boundary look at typed WSS transport, target-owned policy, local process authority, and why the broker is not a proxy.
The real problem is authority, not connectivity
A remote agent needs enough reach to inspect code, create a workspace, run an approved executable, and stream a result. Giving the network path that authority collapses identity, routing, and execution into one dangerous decision. Bernato separates them: the broker routes logical identifiers while the selected node resolves every local capability through its own policy.
This is why an authenticated request is necessary but never sufficient. Device identity answers which node received the message. It does not decide which repository path is valid, which binary may run, or whether a provider has passed containment qualification.
One tunnel, typed frames
The supervised daemon initiates one absolute WSS connection and maintains bounded reconnect backoff and liveness checks. Frames carry explicit kinds, identifiers, sequence information, and bounded payloads. There is no user-supplied TCP destination and no generic byte-forwarding mode.
Separating control, terminal, diff, and decision traffic makes denial observable. An unknown kind, oversized body, stale sequence, or unresolvable target fails before it becomes an operating-system action.
The local policy is the authority root
Logical project and agent names are convenient routing labels. They are not paths or executable names. The node maps them through target-owned configuration, revalidates absolute paths and regular files at trust transitions, and keeps browser input outside the authority graph.
That rule also protects the local Monaco IDE. It listens only on an authenticated numeric-loopback address and cannot be imported into the hosted Firebase bundle.
Recovery is part of the security model
A crashed daemon can leave worktrees, tmux sessions, mailboxes, or receipts half-created. Bernato treats each lifecycle operation as idempotent and records state atomically so restart recovery can converge without granting extra authority.
The result is not “zero risk.” It is a smaller, inspectable set of decisions that can be tested independently.
Production checklist
- Verify Default deny against the deployed environment, not a screenshot.
- Verify No inbound node port against the deployed environment, not a screenshot.
- Verify Bounded execution against the deployed environment, not a screenshot.
- Verify Non-executable memory against the deployed environment, not a screenshot.