Route existing agent logins and isolated Claude API work on owned machines
A self-hosted control desk for existing Claude Code, Codex, and Grok CLI logins, plus an isolated Claude API route. The control plane, called Main, remembers which machine owns a project, where work may happen, who produces, who verifies, what needs approval, and what to do when a connection disappears.
Field notes
The promise is deliberately narrow.Logins
Your CLI logins stay where they already work.SSH routes use the dedicated remote account's authenticated home.
Recovery
SSH vanished. Main did not guess.A missing terminal result becomes needs_reconciliation, never an automatic replay.
Workspaces
Fenced sessions, disposable worktrees.Every code route points at a pre-staged worktree that you reserve for exactly one writer.
Session truth
A single durable session joins the project route, SSH host, disposable worktree, producer, optional verifier, budget semantics, lease epoch, and normalized event history.
Current case / intake INT_0184
Session lease acquired; operator-reserved worktree selected.
One bounded JSON frame crossed SSH stdin. No prompt text entered the command line.
Provider-native output became canonical events and a bounded terminal result.
Sequential, read-only, different family. Exit zero is not enough; the runner expects an exact PASS verdict.
Console status
The current build ships the fleet overview plus Projects, Workflows, Bugfix and backlog, Approvals, Reconciliation, and Settings as functional workspaces, in comfortable or compact density. The live stream shows event structure; message payloads stay redacted.
Healthy nodes
1/11 slot free / 0 nodes need attentionActive turns
00 queued behind active workNeeds decision
0No ambiguous outcomesCodex thread started on the assigned node.
Codex turn started under one fenced session lease.
Content retained on the assigned node.
Provider wrote a diagnostic line to stderr.
Content retained on the assigned node.
Control plane ownership
The split keeps provider-specific streams away from the loopback control plane while preserving enough state to schedule, recover, and audit work.
One record pins node, absolute disposable working directory, profile, producer, optional different-family verifier, write policy, budget, egress list, and relative backlog path. Allow writes, auto-dispatch intake, independent verifier, and approve writes are explicit toggles on the route, not defaults.
Manual, intake, and five-field cron schedules with an IANA timezone all converge on the same durable workflow-run lifecycle.
One form binds workspace, task prompt, and reasoning route: a single agent, or the recommended producer plus verifier pair, each with its own provider, model, and reasoning effort. A route preview shows the verified delivery chain before launch.
Main creates the session, encrypted prompt reference, turn, command ID, idempotency key, budget reservation, and fenced lease before dispatch.
Runners translate Claude, Codex, and Grok output into CanonicalEventV1. Final answer text is stripped from the durable control result.
Companion work can reattach to its host supervisor and spool. Direct SSH cannot, so missing terminal results wait for explicit operator reconciliation.
Intake and schedules
Projects turn short bug, backlog, and feature requests into bounded work. Scheduled fleet operations use the same route rules, but broad writes stop after targets are frozen and before dispatch.
Project
Type
Priority
Title
Instruction
Dispatch reviewed maintenance instructions through one Claude producer route to the eligible trusted SSH subset. This is an agent workflow, not a typed package updater.
Concurrency policy: allow or forbid overlap. Replace is intentionally rejected. A partial fan-out can also enter needs_reconciliation if some nodes changed and others never started.
Execution profiles
These profiles are not interchangeable modes. One narrows a Claude API job inside a Linux sandbox. The other deliberately trusts an owned SSH account so existing Claude, Codex, and Grok subscriptions can be reused.
For unattended, API-funded Claude work through an outbound Linux Companion.
Use when the narrower technical boundary matters more than reusing a subscription login.
For machines and dedicated OS accounts whose home, filesystem permissions, environment, network, and sudo policy you accept as agent scope.
Use when the machine is owned, the account is credential-minimal, and existing CLI subscriptions are the point.
Operator lifecycle
The browser may close. Main, Companion, runner, leases, and spools own the lifecycle beneath it.
Create a manual run, accept project intake, or persist the next cron occurrence in its declared timezone.
Freeze the project route or an eligible explicit/all-node target set. Mixed fleets can produce a deliberate subset.
Write-capable all-node runs and gated project intake remain pending until the local operator reviews scope and instruction.
Create durable state first, reserve budget when metered, acquire the session lease, then send one bounded command.
If configured, start a sequential read-only worker from a different provider family. Only an exact structured PASS completes it.
Record success or failure. If SSH truth is missing, stop in needs_reconciliation and let the operator inspect the workspace.
Security ledger
Isolation is scoped to the provider child, not used as a blanket adjective for the entire system. The operator still owns host setup, worktree discipline, credentials, logs, backups, and rollout.
The UI/API has same-origin checks and no public network authentication boundary. Remote access belongs behind an authenticated local tunnel.
TLS authenticates Main. A per-node bearer token authenticates Companion; Main stores only a one-way verifier.
The bwrap child cannot see the host supervisor's durable spool or control socket. Root Companion and host supervisor remain trusted infrastructure.
The authenticated home, allowed project files, inherited environment, network, and sudo rules are all inside this profile's boundary.
Main fences sessions, not arbitrary filesystem paths. The operator must pre-stage, reserve, review, promote, then reset or discard each code worktree.
Prompt blobs are encrypted at rest. Canonical events, runner state, transcripts, logs, backups, node tokens, and model keys still need protected storage.
Field sequence
Run Control makes the Agent Orchestrator route durable. It does not quietly take ownership of machine trust, promotion, deployment, or incident judgment.
Use a node token and TLS for Companion, or a verified host key, dedicated identity, and forced runner command for SSH.
Create an exclusive worktree outside canonical, shared, deployed, or concurrently written paths.
Choose node, path, profile, producer, optional verifier, write policy, budget, and backlog path.
Review broad write targets. Inspect uncertain SSH workspaces before selecting an explicit outcome.
Apply normal tests, code review, deployment controls, and promotion outside the agent run, then dispose of the worktree.
FAQ
No. It runs those existing CLIs and adds persistent routes, projects, intake, schedules, approvals, normalized events, budget accounting, and recovery rules around them. No custom provider adapter is implemented in Phase 1.
In the dedicated remote user's existing authenticated home. Main receives neither the login tokens nor the provider-native stream. That same home, its environment, project permissions, host network, and any sudo rules become trusted scope.
Yes, when its project has a valid fixed route. The item inherits the registered node, absolute disposable worktree, execution profile, producer, optional verifier, write rule, budget semantics, egress list, and backlog path. Intake can auto-dispatch or remain queued.
It can dispatch reviewed update instructions to the eligible trusted SSH subset. Target resolution includes only healthy, admitted, free-slot, route-compatible nodes, so it may exclude part of a mixed fleet. Because the run targets all nodes and writes, manual approval is mandatory before dispatch.
No. If configured, it adds a sequential, read-only, different-family review. Exit zero is insufficient; the runner requires an exact ORCHESTRATOR_VERDICT: PASS. Tests, human code review, promotion, and deployment controls still apply.
If no terminal result arrived, Main records needs_reconciliation and never auto-replays the prompt. The operator inspects the remote worktree, then explicitly resumes, marks succeeded, marks failed, or terminates.
No. Its fenced lease is session-scoped. The operator must reserve each disposable worktree for one writer and keep humans, other sessions, and external processes out. A producer and verifier may share only because they run sequentially.
The fleet overview, projects, workflows, bug and backlog intake, approvals, reconciliation, and settings workspaces are all functional in the current build, with interaction tests behind them. The interface offers comfortable and compact density, persisted locally in the browser. Cost and budget surfaces are deliberately kept out of the interface while that feature flag is disabled.
Prompt blobs are encrypted at rest, and the live activity stream redacts event payloads. A message entry records that content was produced and retained on the assigned node, not the text itself. Full transcripts stay with the runner on the node that did the work.
Not yet. The implementation has automated tests and Linux cross-build coverage, but the full Linux kernel, systemd, bubblewrap, bundle, egress, cancellation, and restart path still needs a disposable real-host canary. While budget controls remain behind the disabled flag, dispatch and workflow choices are limited to trusted-subscription routes.