docs(adr): agent-consoles Part D — Studio-brokered fs, exec-backed (MCP = federation fallback)

[brettchien]

What

Revises the remote file editor (Part D) backend after the follow-up design call. fs stays Studio-brokered — the management agent never holds a target's credential; the oab grant stays management-only — but the backend is chosen by one axis: does Studio own the target's runtime?

This supersedes the Part D mechanism locked in #70 (fs = a target-exposed MCP server as the sole backend).

The decision

• Backend 1 — Studio platform-exec (primary; every agent in the fleet today). Studio reaches the target's filesystem via the orchestrator's exec channel — ECS ExecuteCommand (SSM) / k8s pods/exec — using a control-plane credential it already holds (it is the plane that scales these services). Ships now, no openab dependency; covers 100% of the current fleet.
• Backend 2 — target-hosted fs MCP server (fallback; federation). For an agent Studio can reach only over /acp but whose platform it does not own, fs rides a small files server the agent exposes, relayed through oab. The previously-decided MCP mechanism; depends on openab, deferred until such an agent exists — exec can't reach a platform Studio doesn't own.

Unchanged: the Studio-brokered topology and the actor (management agent + UI hit one Studio fs surface). The rejected alternative is handing the agent the exec credential / each target's bearer directly — that concentrates cluster-grade RCE in an LLM.

The trade the exec backend buys (stated plainly)

• Enforcement moves resource → Studio. The MCP server enforces roots/writable at the resource; exec has no OS root-fence, so with exec these become Studio-side path validation + argv-form exec — advisory, not resource-enforced. A Studio path-validation bug = full-container write. Mitigations: canonicalization + prefix checks, argv-form (no shell-string interpolation), writable default-off, explicit Apply.
• A control-plane credential enters the fs path — the very credential the earlier draft kept fs away from. Held only by Studio's broker, never granted to an agent. Accepted for owned runtimes because Studio is already that control plane (same trust tier, not a new principal).

Sections touched

• §5 Part D — rewritten around the two-backend model + the deciding axis.
• §6 / §7 — read+write now ship over exec for owned runtimes (no openab); the MCP server becomes the deferred federation fallback; security consequences updated (enforcement locus, control-plane cred in the fs path).
• §8 — OQ#1 re-resolved (two backends); new OQ#2 on the exec backend's enforcement locus.
• Closing slices — (4) read+write over the exec backend (no openab), (5) federation MCP backend when a Studio-un-owned agent needs it.

Docs-only.

🤖 Generated with Claude Code