Four-Pillar Multi-Agent Platform · v1.3.0

Enterprise Mission Control

Mission Control upgrades the sovereign CodeAct loop into a governed multi-agent developer platform. The existing WASM runtimes, terminal multiplexers, diff viewers, token metering, APIs and state stores are unchanged; the four pillars add verification, architecture awareness, safe patching and isolated concurrency on top.

Tri-Surface VerificationArchitecture GraphAST Patch GuardWorker IsolationHuman Sign-Off

The Four Pillars

Pillar A — Tri-Surface Verification & Artifacts

Every mission is verified on three independent surfaces before it can be considered complete.

  • Static surface: deterministic syntax and structure checks for TypeScript/TSX, JavaScript/JSX, Python, JSON, HTML, CSS, SQL, Go and Rust.
  • Browser surface: sandboxed allow-scripts iframe with an in-memory DOM preview, no same-origin access, no forms, popups or outbound network.
  • Terminal/WASM surface: allow-listed shell commands and the existing sovereign WASM interpreter engine (Pyodide, V8, Rust, Go, SQLite).
  • Immutable artifacts: Plan & Spec, Atomic Patch Set and Verification Matrix, each content-addressed and sealed in a frozen bundle.
  • Integrity verification on every read; tampering is detected and rejected by the artifact store.

Pillar B — Architecture Graph & Context Slicing

A living, incrementally rebuilt graph of the repository feeds token-budgeted context to the agent.

  • Indexes files, imports, exports, components, API routes, Next.js pages, SQL schemas, external services and circular imports.
  • Rebuilds on workspace load and on every accepted change so context never drifts from disk.
  • Produces Pak-LLM BPE-aware, token-budgeted context slices instead of dumping the whole repository.
  • Highlights circular dependencies and route/schema/service inventory in the console.

Pillar C — AST-Guarded Patch Engine

Unified diffs are validated before they can touch the virtual filesystem, then staged hunk by hunk.

  • jsdiff Myers unified hunks parsed into individual, reviewable hunks.
  • Pre-write AST guard rejects unbalanced delimiters, unterminated strings/templates/comments, invalid JSON, unsafe HTML and javascript: URLs.
  • Invalid patches are aborted; deterministic self-healing closes unclosed delimiters only when it converges.
  • Hunk-level accept/reject UI lets reviewers apply part of a proposal without accepting the rest.
  • Atomic Patch Set artifact records every accepted and rejected hunk with provenance.

Pillar D — Multi-Worker & Worktree Isolation

Concurrent workers never mutate the base workspace until a governed merge is approved.

  • Documentation, test-authoring, security-review and refactor workers run concurrently with bounded concurrency.
  • Default isolation uses per-worker virtual branch snapshots (pak-worker/<id>) with copy-on-write file maps.
  • Real git worktree isolation is opt-in, admin-only, and confined to a trusted root.
  • Merges require milestone completion, a passing verification matrix and explicit human sign-off.
  • Base-workspace drift is detected and reported as a conflict instead of silently overwriting.

Opening the Console

Open any workspace in Mission Control and select Enterprise in the toolbar, or use Tools → Enterprise Mission Control. The console runs client-first: architecture indexing, context slicing, AST validation and virtual worker snapshots stay in your browser session. Repository content leaves the device only when you explicitly request a server verification or persist an artifact bundle.

  1. Enter a mission objective and optional token budget.
  2. Enable workers and choose documentation, test, review or refactor roles.
  3. Review the architecture graph and the injected context slice.
  4. Inspect the proposed hunks and accept or reject them individually.
  5. Run the verification matrix and self-heal deterministic failures.
  6. Sign off to merge verified worker branches into the workspace.

API Endpoints

POST/api/mission-control/verify

Runs the static surface and architecture graph on an uploaded workspace snapshot. Authenticated, rate-limited to 30 requests/minute, 250 files, 300 KB per file and 2 MB total. Payloads are path-normalized and not retained.

GET / POST/api/mission-control/artifacts

Lists or persists immutable mission artifact bundles. Persisting verifies content integrity first and rejects tampered bundles (schemaVersion 1.0, 1 MB max).

GET/api/mission-control/audit

Admin-only. Returns the mission audit trail, chain-integrity result, the server audit ledger, and the ISO/NIST/OWASP compliance matrix. Requires x-pak-llm-admin-key.

POST/api/mission-control/workers

Admin-only, opt-in real git worktree operations (create/list/remove). Executes git through an argv-only execFile call with shell disabled and validated branch/worktree names.

Environment Flags & Opt-In Isolation

Virtual branch isolation is always available and is the default. Real git worktrees are opt-in and require all three variables below.

VariableValuePurpose
PAK_LLM_WORKTREE_ENABLEDtrueEnables the real git worktree adapter. Disabled by default; virtual branch isolation is always available.
PAK_LLM_WORKTREE_ROOTabsolute pathTrusted repository root. Every worktree path is resolved inside this directory.
PAK_LLM_ADMIN_SECRETstrong secretRequired by the admin audit and worktree endpoints. Compared in constant time.

Git is executed through an argv-only execFile call with shell: false. Branch names, worktree names and repository paths are validated before execution; absolute paths and traversal segments are rejected.

Compliance Mapping

ISO/IEC 25010

Functional suitability, performance efficiency and security verified across three surfaces.

ISO/IEC 27001 A.12.4

Hash-chained audit ledger for mission, patch, worker, merge and artifact events.

ISO/IEC 42001 & NIST AI RMF

Per-worker isolation, capability permissions and human-in-the-loop merge gates.

NIST SP 800-53 AC-3 / AC-6

Least-privilege capability policies and rate limits; writes, terminal and worktrees need approval.

NIST SP 800-53 AU-6 / SI-2 / SI-7

Audit review, deterministic self-healing and artifact/patch integrity verification.

OWASP LLM01 / LLM02 / LLM08

Context sanitization, safe output handling and excessive-agency controls.

OWASP Web Top 10 / CWE-22 / CWE-78 / CWE-79

Path traversal, command injection and unsafe-preview defenses.

SGS reproducibility

Seeded hashes, stable JSON ordering and a deterministic regression suite.

Local Development & Regression Suite

The pillar libraries are dependency-light and isomorphic. Only diff(jsdiff, BSD-3-Clause) is added at runtime. The regression suite uses the native Node test runner.

# Type-check the whole web app
npx tsc --noEmit -p apps/web/tsconfig.json

# Run the Mission Control regression suite (Node 25+)
npm --prefix apps/web run test:mission-control

# Production build
npm run build

The suite covers hashing determinism, BPE token metering, architecture graph indexing and context budgets, AST validation and self-healing, hunk staging, CWE-22/CWE-78 guards, OWASP LLM01 sanitization, SSRF rejection, NIST AC-3/AC-6 permissions, audit-chain tamper detection, tri-surface verification, virtual worktree isolation, merge gates, artifact integrity, git worktree validation, the closed-loop orchestrator, and fuzz robustness.

Security ControlsCompliance HubFeature SpecsChangelog
Open Enterprise Mission Control
Enterprise Mission Control — Four Pillars | Pak-LLM Coder | Pak-LLM Coder