Corey James- 1 MiBcap on every frame a privileged server will read
- 3JSON-lines protocols over local sockets
- 1account each server will answer
A privileged manager behind typed local protocols
Helix has to create and control vendor CLI sessions, which takes privileges I did not want in the processes that talk to models. I split the privileged part into a small manager and put Unix sockets between it and everything else.
The control center speaks JSON-lines protocols over local sockets: service to session manager, service to the per-vendor adapters, and browser terminal attach. Every server checks the connecting process's user ID against the one account allowed to call it, because a socket path says nothing about who connected, and a hard frame cap keeps a misbehaving client from making a privileged process allocate without bound.
Adapter replies carry correlation fence tokens, so a late reply from an older session generation is dropped. Outgoing events pass through an outbox flushed to disk, so a restart loses nothing and duplicates nothing.
The line is the cap; frame sizes illustrative.
Narrow bridges that start on demand
AgentOS needed a way for exactly one service account to start governed work. I used a systemd socket-activated Unix socket, which starts the bridge on demand and sets its permissions in one place: when a request arrives, the activation bridge checks the caller's user ID and only then grants an execution lease on a work order.
A similar narrow bridge crosses user boundaries for the helpdesk channel, through which a managed team lead reports harness defects to a human-supervised session, so AgentOS services never read the operator's own provider configuration. Messages reach frontier model command-line sessions through that tool's local inbox socket.
No network listener where none is needed
FAFOHive reaches its Reddit integration through a private Unix socket. I gave that provider no TCP port: the hub forwards to the socket, and on the other side a native-messaging host links it to a browser extension. A service that needs no network listener gets none.
The sockets are standard operating-system facilities; the protocols on them are mine.
I design local process boundaries with the care most people reserve for network APIs: typed, size-limited, authenticated by peer identity and safe to restart.