F0RLE · F0RLE · May 29, 2026 · May 21, 2026 · May 21, 2026 · May 21, 2026
@@ -24,10 +24,12 @@ jobs:
     runs-on: windows-latest
     timeout-minutes: 25
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        with:
+          persist-credentials: false
 
       - name: Setup Node.js
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
         with:
           node-version: "26.1.0"
           cache: "npm"
@@ -82,7 +84,9 @@ jobs:
     runs-on: windows-latest
     timeout-minutes: 40
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        with:
+          persist-credentials: false
 
       - name: Setup Rust
         uses: dtolnay/rust-toolchain@631a55b12751854ce901bb631d5902ceb48146f7 # stable
@@ -136,3 +140,62 @@ jobs:
         with:
           name: rust-lcov
           path: src-tauri/lcov.info
+
+  check-cross-platform:
+    name: Cross-platform Compatibility (${{ matrix.os }})
+    runs-on: ${{ matrix.os }}
+    timeout-minutes: 35
+    continue-on-error: true
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [ubuntu-latest, macos-latest]
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        with:
+          persist-credentials: false
+
+      - name: Install Linux system dependencies
+        if: runner.os == 'Linux'
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y \
+            libwebkit2gtk-4.1-dev \
+            libayatana-appindicator3-dev \
+            librsvg2-dev \
+            patchelf \
+            libxdo-dev
+
+      - name: Setup Node.js
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
+        with:
+          node-version: "26.1.0"
+          cache: "npm"
+          cache-dependency-path: src/package-lock.json
+
+      - name: Setup Rust
+        uses: dtolnay/rust-toolchain@631a55b12751854ce901bb631d5902ceb48146f7 # stable
+        with:
+          toolchain: 1.95.0
+
+      - name: Rust Cache
+        uses: Swatinem/rust-cache@65012b490220f477f20ab979e35ae732e6de4e68 # node24
+        continue-on-error: true
+        with:
+          workspaces: "src-tauri -> target"
+          cache-targets: false
+
+      - name: Install Dependencies
+        run: |
+          cd src
+          npm ci
+
+      - name: Frontend Type Check
+        run: |
+          cd src
+          npm run typecheck
+
+      - name: Backend Target Check
+        run: |
+          cd src-tauri
+          cargo check --all-targets --all-features
@@ -35,7 +35,9 @@ jobs:
 
         steps:
             - name: Checkout repository
-              uses: actions/checkout@v6
+              uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+              with:
+                  persist-credentials: false
 
             - name: Setup Rust
               if: matrix.language == 'rust'

@@ -24,7 +24,9 @@ jobs:
         timeout-minutes: 10
         steps:
             - name: Checkout repository
-              uses: actions/checkout@v6
+              uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+              with:
+                  persist-credentials: false
 
             - name: Review dependency changes
               uses: actions/dependency-review-action@v5

@@ -31,8 +31,9 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
         with:
+          persist-credentials: false
           fetch-depth: 0
           ref: ${{ env.RELEASE_TAG }}
 
@@ -59,7 +60,7 @@ jobs:
           }
 
       - name: Setup Node.js
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
         with:
           node-version: "26.1.0"
           cache: "npm"

@@ -19,10 +19,12 @@ jobs:
         timeout-minutes: 20
         steps:
             - name: Checkout repository
-              uses: actions/checkout@v6
+              uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+              with:
+                  persist-credentials: false
 
             - name: Setup Node.js
-              uses: actions/setup-node@v6
+              uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
               with:
                   node-version: "26.1.0"
                   cache: "npm"
@@ -44,7 +46,9 @@ jobs:
         timeout-minutes: 25
         steps:
             - name: Checkout repository
-              uses: actions/checkout@v6
+              uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+              with:
+                  persist-credentials: false
 
             - name: Setup Rust
               uses: dtolnay/rust-toolchain@631a55b12751854ce901bb631d5902ceb48146f7

@@ -1,6 +1,6 @@
 # Axelate Current State
 
-> Repository-grounded snapshot as of 2026-05-16.
+> Repository-grounded snapshot as of 2026-05-21.
 > This document describes what exists now, not what the future product aspires to become.
 
 For setup and contributor workflow, use [Getting Started](GETTING_STARTED.md) and [Development Workflow](DEVELOPMENT_WORKFLOW.md).
@@ -17,13 +17,16 @@ Today the repository is closest to:
 - a launcher for local AI runtimes and script modules
 - a BYOK cloud model client centered on OpenRouter
 - a control surface for downloads, monitoring, logs, and settings
+- the start of a local API surface that integrations can use to call AI, manage
+  module settings, report progress, and control their own lifecycle
 
 Today the repository is not yet:
 
 - a reviewed package distribution layer
 - a full package distribution platform
 - a managed runtime platform
 - a mature MCP-first workstation
+- a permissioned agent-control platform
 - a finished public product with stable distribution and operations
 
 ## Current Stack
@@ -121,6 +124,23 @@ Confirmed current direction from the codebase and recent fixes:
 - session summaries are hidden system context, not meant to leak into visible replies
 - rate-limit and payment errors are separated more cleanly than before
 
+### Local Integration API
+
+The repository has a loopback-only local HTTP API for launcher-managed
+integrations. It currently supports:
+
+- health checks
+- listing installed integrations
+- reading integration status and runtime context
+- reading and updating module-owned settings
+- reporting module stage/progress
+- starting, stopping, and restarting modules
+- text and image AI requests through backend-owned routing
+
+This is not yet a full agent control plane. It is the right base for one because
+it already uses local bearer tokens, scoped module routes, backend-owned state,
+and documented `/v1` endpoints.
+
 ### Image Provider Path
 
 The repository contains API provider catalog data for image-capable providers.
@@ -276,6 +296,10 @@ The repository still contains surfaces or ideas that are ahead of the stable pro
 
 What does not exist yet as a finished system:
 
+- agent scopes and approval prompts
+- sanitized log APIs meant for external agents
+- integration draft generation through the launcher
+- an Axelate MCP server backed by documented launcher capabilities
 - package signing service
 - verified package distribution
 - managed runtime orchestration
@@ -337,9 +361,11 @@ The next useful work should stay in this order:
    should be boring and repeatable.
 2. Integration safety: imported folders, archives, URLs, runtime paths, settings,
    tokens, and logs should have explicit ownership boundaries.
-3. Trust visibility: users should see the difference between local manual imports,
+3. Agent-ready local control: agents should inspect status, logs, settings, and
+   lifecycle through documented APIs instead of UI scraping or private files.
+4. Trust visibility: users should see the difference between local manual imports,
    future verified packages, and future managed or hybrid execution.
-4. Provider clarity: cloud routing should remain useful without making OpenRouter
+5. Provider clarity: cloud routing should remain useful without making OpenRouter
    the permanent product identity.
 
 Recent hardening direction:

@@ -1,9 +1,14 @@
 # Integration API
 
-This guide describes the current versioned contract external integrations use to
-control Axelate. The contract is language-neutral: every integration talks to the
-launcher through a local HTTP API. Language clients can wrap this contract later,
-but the HTTP API is the source of truth.
+This guide describes the current versioned contract launcher-managed
+integrations use to talk to Axelate. The contract is language-neutral: every
+integration talks to the launcher through a local HTTP API. Language clients can
+wrap this contract later, but the HTTP API is the source of truth.
+
+This API is also the base for future agent control. The current contract is
+module-scoped and conservative. A separate Agent Control layer can add broader
+observe, operate, configure, and draft-create scopes later, but it should reuse
+the same local, authenticated, backend-owned design.
 
 For scaffolding, validation, and examples, start with
 [Integration Development](INTEGRATION_DEVELOPMENT.md).
@@ -34,6 +39,10 @@ Standalone tools that are not launched by Axelate are not the primary public
 contract yet. They should use a launcher-managed integration flow instead of
 persisting or guessing local API credentials.
 
+External agents should follow the same rule for now. They should not scrape the
+desktop UI or read Axelate data files directly. The supported path is a
+launcher-issued token and documented `/v1` endpoints.
+
 Script integrations declare their runtime in `axelate-module.toml`.
 
 ```toml
@@ -67,6 +76,16 @@ Module-scoped tokens can access shared AI endpoints and only that module's own
 `/v1/modules/{moduleId}/...` routes. They are not durable credentials and should
 not be stored outside the running process.
 
+Future agent tokens should not reuse module tokens. They need their own scopes:
+
+- `observe`: read health, status, module lists, and sanitized logs
+- `operate`: start, stop, restart, and repair existing items
+- `configure`: update settings after user approval where needed
+- `draft-create`: create integration drafts without installing them silently
+
+Secrets should stay out of all agent responses unless a later explicit consent
+flow says otherwise.
+
 ## Client Rules
 
 - Treat `AXELATE_HTTP_API_BASE` and `AXELATE_HTTP_API_TOKEN` as runtime values.
@@ -179,6 +198,24 @@ settings = requests.get(
 
 Does not require authentication. Returns whether the local API server is alive.
 
+### Future Agent Control
+
+The current `/v1/modules` and `/v1/ai` endpoints are enough for launcher-managed
+integrations. They are not yet a full agent control plane.
+
+The planned Agent Control layer should add:
+
+- launcher overview and health summary
+- provider and model inventory
+- download and runtime status
+- sanitized log reads
+- dry-run responses for install, delete, repair, and settings changes
+- audit entries for agent actions
+- integration draft creation from templates
+
+Mutating operations should stay behind explicit scopes and user approval where
+the action can install code, delete data, expose logs, or change credentials.
+
 ### Integrations
 
 `GET /v1/modules`

@@ -15,7 +15,8 @@ English documentation is the canonical reference for Axelate.
 ## Integrations
 
 - [Integration Development](INTEGRATION_DEVELOPMENT.md) - build local integrations
-- [Integration API](INTEGRATION_API.md) - local HTTP API contract
+- [Integration API](INTEGRATION_API.md) - local HTTP API contract and future
+  agent-control base
 - [Custom Integrations](CUSTOM_INTEGRATIONS.md) - manifest and import rules
 
 ## Planning