CesSpace ARC — Secure Agent-to-Machine Control Plane

CesSpace ARC (Agent Remote Control) is a secure, vendor-neutral control plane providing policy-enforced, audited access to development machines, virtual machines, repositories, terminals, and processes for authorized AI coding agents. Lead Developer & Architect: P Thakur

1. Mission & Vision

Modern AI coding agents (Claude Code, Antigravity, OpenAI Codex, OpenCode, DeepSeek agents) require rich interactions with host environments—reading files, inspecting diffs, running tests, and executing builds. However, giving autonomous agents unrestricted ambient access (such as open SSH keys, raw /bin/sh evaluation, or unfettered root access) creates severe security risks:

• Accidental or malicious filesystem destruction.

• Credential harvesting (~/.ssh, ~/.aws, .env).

• Indirect prompt injection leading to remote code execution.

• Silent repository or supply chain tampering.

CesSpace ARC mediates every single agent action through an authoritative policy engine, an OS-level filesystem jail, and an append-only audit trail.

Related MCP server: MCP SSH Orchestrator

2. High-Level Target Architecture

AI Client / Coding Agent (Claude Code / Antigravity / Codex / DeepSeek)
                          │
                          ▼
             MCP Interface (JSON-RPC 2.0)
                          │
     ═════════════════════╪═══════════════════════ Trust Boundary 1 (Ingress)
                          ▼
                 ARC Remote Gateway
                & Authentication Engine
                          │
     ═════════════════════╪═══════════════════════ Trust Boundary 2 (Policy)
                          ▼
                    Policy Engine
            (RC-01: Minimal Security Kernel;
             RC-04: Declarative Rules & Approvals;
             Precedence: DENY > REQUIRE APPROVAL > ALLOW)
                          │
                          ▼
                     Audit Layer
            (RC-01: In-Memory / Stream Sink;
             RC-06: Anchored Persistent Log)
                          │
     ═════════════════════╪═══════════════════════ Trust Boundary 3 (Host Execution)
                          ▼
                    ARC VM Agent
                          │
         ┌────────────────┼────────────────┬────────────────┐
         ▼                ▼                ▼                ▼
    Filesystem           Git            Terminal        Processes
  (Jailed Roots)   (Branch Guard)    (Bounded execve)  (Tree Superv.)

Mandatory Invariant: No Filesystem, Git, Terminal, or Process operation may ever execute without traversing the full Authentication $\to$ Policy Engine $\to$ Audit Layer pipeline. In RC-01, this invariant is satisfied via the Minimal Security Kernel, which enforces default-deny admission, canonical workspace root binding, and audit logging before any tool runs.

3. The 20 Permanent Security Principles

1. Zero implicit trust

2. Default deny

3. Least privilege

4. Fail closed

5. Separation of authentication and authorization

6. Mandatory policy mediation for every privileged operation

7. No policy bypass

8. Authorized filesystem roots only (strict canonical jailing & descriptor containment)

9. Secrets and credential stores permanently inaccessible by default

10. Policy-controlled subprocess execution without shell interpolation

11. Destructive operations denied by default

12. Zero cloud-root or production access in public defaults

13. Universal auditability for every privileged action

14. Protected Git branches (main, release/*) immutable to agents

15. Explicit human approval for sensitive mutations

16. Prohibition of private CES secrets, infrastructure details, and tokens

17. Permanence of committed secrets (Git history treated as public and forever)

18. Vendor neutrality across AI model providers and platforms

19. Code-enforced security invariants (never documentation alone)

20. Mandatory negative controls proving blocked operations fail

4. Documentation Index

The complete architecture and security foundation of CesSpace ARC is documented below:

5. Toolchain & Monorepo Configuration

CesSpace ARC is standardized on:

• Node.js: ^24.0.0

• Package Manager: pnpm@12.4.2 (pnpm-workspace.yaml)

• Internal Dependency Protocol: workspace:*

• Access: All internal packages are marked private: true during development stages.

6. Development Roadmap & Stages

7. License

CesSpace ARC is licensed under the Apache License, Version 2.0.