APC Workstation — Complete Machine Documentation

Document version: 1.3 Last updated: 2026-07-29 Author: OMax Classification: Internal DeDynamics — Machine Reference

Change Log

Version	Date	Author	Changes
1.0	2026-07-29	OMax	Initial complete machine documentation
1.1	2026-07-29	OMax	Added God Clearance detailed docs; corrected RAM to 16GB DDR4; added `DDPRO_MAXMEM_CALLS=200`; added change log; added DDpro-Docs MCP root; added documentation update policy; added cross-reference to DDpro-NET.md; restructured sections 13-15
1.2	2026-07-29	OMax	Added docs deployment section; Cloudflare MCP servers added to opencode-god config; VitePress docs site deployed to Cloudflare Pages
1.3	2026-07-29	OMax	Fixed sidebar anchors (_ prefix for numbered heading IDs); fixed logo serving (publicDir workaround); removed GitHub link; replaced logo with DDpro stamp

1. Overview

APC (Aleks' Primary Computer) is an Ubuntu 26.04 LTS mini PC that serves as the primary engineering workstation and the host for the entire DDpro-Net agentic harness ecosystem. It runs 24/7 from Aleks' home office (NL), providing the runtime for MCP servers, agent coordination (MaxMem), Cloudflare tunnel connectivity, and all DeDynamics repository operations.

APC is the home station for agents: OMax, Codex, OMaxMap, Admin. Remote counterpart: JPC (UK) — runs JCodex and JMax. Mobile clone: Pixel 7 — runs PixOMax.

2. Hardware Specifications

System

Item	Detail
Form Factor	x86_64 mini PC
Hostname	`apc`
CPU	Intel N100 (Alder Lake-N, quad-core, 4 threads, 6MB L3 cache)
GPU	Intel UHD Graphics (integrated in N100 SoC)
RAM	16 GB DDR4
ECC	None
Firmware	UEFI

Storage

Device	Size	Type	Mount	Filesystem	Purpose
`/dev/sdb3` (on LVM)	116.2G	M.2 SSD	—	LVM2	Physical volume
`ubuntu--vg-ubuntu--lv`	81.2G	LVM logical volume	`/`	ext4	OS + installed software
`ubuntu--vg-ddpro--net`	35G	LVM logical volume	`/mnt/ddpro-data`	ext4	All DeDynamics data
`/dev/sda3`	237.6G	USB SSD	`/run/media/aleks/DeDynamics`	ntfs3	External/storage
`/dev/sdc1`	58.6G	USB drive	`/run/media/aleks/OMax`	ext4	OMax USB transit clone
`/dev/sdb1`	1G	—	`/boot/efi`	vfat	EFI system partition
`/dev/sdb2`	2G	—	`/boot`	ext4	Boot partition

Networking

Interface	Type	Status	Notes
`enp1s0`	Realtek RTL8111 (GigE)	DOWN	Wired Ethernet (not connected)
`enp3s0`	Realtek (GigE)	DOWN	Second Ethernet (not connected)
`wlp2s0`	WiFi (Unknown chipset)	UP	Main connection, DHCP, IP 10.91.137.9/24
Gateway	10.91.137.81	—	Router
DNS	127.0.0.53 (systemd-resolved)	—	—

USB & Peripherals

Bluetooth Radio (Realtek RTL8821CE)
Samsung Galaxy (MTP mode)
Logitech USB Mouse
CASUE USB Keyboard
CH340 USB-to-Serial converter
Nor-Tec USB microphone
USB Audio and HID device

3. Operating System

OS Details

Field	Value
OS	Ubuntu 26.04 LTS
Codename	Resolute Raccoon
Kernel	7.0.0-28-generic (PREEMPT_DYNAMIC)
Architecture	x86_64 (amd64)
Compiler	GCC 15.2.0-16ubuntu1
Shell	bash
User	`aleks` (full sudo access)
Desktop	GNOME (via GDM)
Display Manager	GDM
Init System	systemd

State

Metric	Value
Uptime	~2h (varies, usually continuous for days)
CPU Load	1-2 avg (idle)
RAM used	~5 GB / 16 GB (31%)
RAM available	~9 GB
Swap	11 GB (0 used)
Disk `/`	56 GB / 80 GB (74%)
Disk `/mnt/ddpro-data`	4.1 GB / 35 GB (13%)

4. DDpro-Net — The Central Agentic Harness

DDpro-Net is the core DeDynamics infrastructure running on APC. It provides:

MCP Server — Authenticated gateway for all agent → repo/environment operations
MaxMem — Shared persistent memory across all agents (OMax, Codex, JCodex, OMaxMap, PixOMax)
Session Protocol — Cross-agent coordination with session start/end, claims, and handoffs
Tunnel — Cloudflare tunnel for remote access (JPC/Codex, ChatGPT Max/JMax)
Security — MaxMem guard, SHA-256 conflict-safe writes, path deny-lists, binary detection

DDpro-Net Architecture

                    ┌──────────────┐
                    │  Cloudflare  │
                    │  Tunnel      │
                    └──────┬───────┘
                           │ HTTPS
                    ┌──────▼───────┐
                    │  MCP Server  │
                    │  :3333       │
                    └──┬───┬───┬───┘
                       │   │   │
              ┌────────┘   │   └────────┐
              ▼            ▼            ▼
        DDpro-Git    DDpro-Env    DDpro-Ops
        (13 repos)   (skills,     (ops files,
                     plugins,     templates,
                     knowledge,   inbox)
                     memory)
                       
              ┌────────────┐
              │ DDpro-Docs │  ← NEW: machine docs, reports
              └────────────┘

Key Paths

Resource	Absolute Path	Purpose
DDpro-Git root	`/mnt/ddpro-data/DDpro-Git`	All DeDynamics repositories
DDpro-Env root	`/mnt/ddpro-data/DDpro-Env`	Skills, plugins, knowledge, memory, logs
DDpro-Ops root	`/mnt/ddpro-data/DDpro-Ops`	Operations, content, support, admin, projects
DDpro-Docs root	`/mnt/ddpro-data/DDpro-Docs`	Machine docs, reports, system knowledge
DDpro-Sec root	`/mnt/ddpro-data/DDpro-Sec`	Secrets storage (not accessible via MCP)
Master AGENTS.md	`/mnt/ddpro-data/DDpro-Git/AGENTS.md`	Central agent instructions
Ecosystem manifests	`/mnt/ddpro-data/DDpro-Git/_dd-ecosystem/`	Agent profiles, workflows, operations docs
Agent memory	`/mnt/ddpro-data/DDpro-Env/agent-memory/`	MaxMem JSONL stores
MCP logs	`/mnt/ddpro-data/DDpro-Env/mcp-logs/`	`dedynamics-local-mcp.log`
OpenCode config	`/home/aleks/.config/opencode/opencode.jsonc`	MCP connections, plugins, skills, instructions
MCP server source	`/mnt/ddpro-data/DDpro-Git/dedynamics-local-mcp/`	TypeScript source for the MCP server
MCP server deployment	`/opt/dedynamics/ddpro-mcp/current/`	Built & running instance
Agent secrets	`/mnt/ddpro-data/AGENTS/.secrets/`	Cloudflare API tokens, MCP tokens, env files
Agent token dirs	`/mnt/ddpro-data/DDpro-Sec/mcp-local-auth/`	Local Bearer tokens per agent
Backups	`/mnt/ddpro-data/BACKUP/`	System backups, templates, scripts
OMax USB	`/run/media/aleks/OMax/`	Portable clone drive
External storage	`/run/media/aleks/DeDynamics/`	NTFS USB SSD

MCP Server Details

Property	Value
Software	`dedynamics-local-mcp`
Version	0.9.1
Runtime	Node.js v22.22.1
Port	3333 (localhost only)
Auth	OAuth + local service bearer tokens
Write mode	Enabled (git + ops + docs)
Max repo write	Enabled for aleks role
Ops write	Enabled
Service file	`/etc/systemd/system/ddpro-mcp.service`
Drop-in configs	`/etc/systemd/system/ddpro-mcp.service.d/allow-sudo.conf`, `local-creds.conf`
Environment file	`/mnt/ddpro-data/AGENTS/.secrets/ddpro-mcp.env`
Log location	`/mnt/ddpro-data/DDpro-Env/mcp-logs/dedynamics-local-mcp.log`

Allowed MCP Roots (controlled by server config)

/mnt/ddpro-data/DDpro-Git — Repository writes (SHA-256 guarded)
/mnt/ddpro-data/DDpro-Env — Environment reads only (inventory, context docs)
/mnt/ddpro-data/DDpro-Ops — Operations read/write (templates, inbox, projects)
/mnt/ddpro-data/DDpro-Docs — Documentation read/write (reports, machine docs)

Forbidden MCP Operations

Shell/arbitrary command execution
Deployment commands
Remote git synchronization
Git branch switching or history rewrites
File deletion
Secret/.env/credential editing
Production Cloudflare modification (without explicit authorization)

5. Agent Ecosystem

Human Operators

Person	Role	Workstation	Agent
Aleks	Founder/operator/engineer	APC (NL), JPC (UK)	All agents
Joe	COO/ops/content/support	JPC (UK)	JMax

Production Agents

Agent	Workstation	Role	MCP Identity
OMax	APC	Central coordination, prompt engineering, deploy agent	`omax`
Codex	APC	Primary implementation agent	`codex`
OMaxMap	APC	Mapper+/Admin/Amethyst Toolkit specialist	`omaxmap`
Admin	APC	System administration (only agent with run_terminal)	`admin`

Preview / Remote Agents

Agent	Workstation	Role	MCP Identity
JCodex	JPC (UK)	Remote implementation agent	`jcodex`
JMax	JPC (UK)	Joe's operations/content assistant	`jmax`
PixOMax	Pixel 7	Mobile portable OMax clone	`pixomax`
OMax-clone	USB drive	Transit clone for travel machine	`omax-clone`
Antigravity	—	Experimental (not yet deployed)	`antigravity`

Agent Memory Usage (MaxMem)

Agent	Private Memories
OMax	177
Codex	5
JCodex	3
OMaxMap	5
PixOMax	1
OMax-clone	4
Admin	1
Shared memory (all)	165
Worklog entries	957

6. Running System Services

DeDynamics Core Services

Service	Status	Description
`ddpro-mcp.service`	Active	DDpro MCP Server (Node.js, :3333)
`cloudflared.service`	Active	Cloudflare Tunnel for remote MCP access

Security Services

Service	Status	Description
`fail2ban.service`	Active	Brute-force intrusion prevention
`clamav-daemon.service`	Active	ClamAV virus daemon
`clamav-freshclam.service`	Active	AV signature auto-updater
`ufw`	Installed	Uncomplicated Firewall (GUFW GUI)
`rkhunter`	Installed	Rootkit hunter (systemd timer)
`chkrootkit`	Installed	Rootkit detection (systemd timer)

Desktop Services

Service	Status	Description
`gdm.service`	Active	GNOME Display Manager
`bluetooth.service`	Active	Bluetooth stack
`NetworkManager.service`	Active	Network management
`avahi-daemon.service`	Active	mDNS/DNS-SD (local discovery)
`cups.service` / `cups-browsed.service`	Active	Printing
`chrony.service`	Active	NTP time sync
`rsyslog.service`	Active	System logging
`fwupd.service`	Active	Firmware update daemon
`haveged.service`	Active	Entropy daemon
`power-profiles-daemon.service`	Active	Power management
`colord.service`	Active	Color profile management
`geoclue.service`	Active	Location service
`ModemManager.service`	Active	Mobile broadband
`Proton VPN`	Active	VPN split tunneling

7. Software & Development Tooling

Core Engineering

Tool	Version	Notes
OpenCode CLI	1.17.20	Agent runtime, at `/home/aleks/.opencode/bin/opencode`
Node.js	v22.22.1	npm 9.2.0, libnode-dev 22
Wrangler	4.110.0	Cloudflare Workers/Pages CLI
Git	2.53.0	Local-only (no remote configured)
GCC	15.2.0	C/C++ compiler
@openai/codex	0.145.0	Codex CLI (global npm), used by Codex agent
curl	8.18.0	HTTP client
cloudflared	2026.7.3	Cloudflare Tunnel client

IDEs & Desktop Tools

Tool	Install Method	Purpose
WebStorm	Flatpak	JetBrains IDE for JS/TS development
ecode	Flatpak	Lightweight code editor
OmniDev	Flatpak	Dev toolbox
Chromium	Snap	Browser for testing
Firefox	Snap	Browser for testing
ChatGPT Desktop	Snap	ChatGPT GUI client

Productivity

Tool	Install Method	Purpose
AppFlowy	Flatpak	Project management / notes
Trilium Notes	Flatpak	Knowledge base / note-taking
Pinta	Flatpak	Image editing
Resonance	Flatpak	Audio
Spotify	Flatpak	Music

Utilities

Tool	Install Method	Purpose
Geekbench 6	Flatpak	Benchmarking
SafeScript	Flatpak	Script runner
GUFW	Native (apt)	Firewall GUI

8. Storage Layout — Mapped

/mnt/ddpro-data/                          ← ddpro-net LVM volume (35G, 13% used)
├── AGENTS/                               ← Agent configs, secrets, tokens
│   ├── .secrets/                         ← Cloudflare tokens, MCP env
│   ├── OpenCode/OMaxMap/                 ← OMaxMap OpenCode config
│   └── MAX/                              ← Max/ChatGPT configs
├── BACKUP/                               ← System backups (manual + scheduled)
│   ├── RUN-BACKUP.md                     ← Backup procedure
│   ├── _templates/                       ← Report templates
│   └── auto-backup.*                     ← Automation scripts
├── DDpro-Env/                            ← Environment root (MCP allowed root)
│   ├── .agents/skills/                   ← Built-in skills (cloudflare, durable-objects, etc.)
│   ├── skills/                           ← DeDynamics-specific skills
│   ├── plugins/                          ← maxmem-guard.mjs, memory.mjs
│   ├── _Knowledge/                       ← Architecture docs, agent context
│   ├── agent-memory/                     ← MaxMem JSONL stores
│   ├── mcp-logs/                         ← Server logs
│   └── _opencode-memory/                 ← OpenCode simple memory fallback
├── DDpro-Git/                            ← Git repos root (MCP allowed root)
│   ├── AGENTS.md                         ← Master agent instructions
│   ├── _dd-ecosystem/                    ← Workflows, agent profiles, operations
│   ├── amethyst-mapper-plus/             ← Main product repo
│   ├── amethyst-mapper-plus-preview/     ← Preview copy
│   ├── ddpro-admin-center/               ← Admin panel
│   ├── dedynamics-local-mcp/             ← MCP server source
│   ├── amethyst-sessions/                ← Session Worker
│   ├── amethyst-toolkit-platform-V1/     ← New AMToolkit platform
│   ├── mapper-plus-agent-plugin/         ← MCP plugin for Mapper+
│   ├── amtoolkit-site/                   ← Marketing site
│   ├── aleks-business-card/              ← Aleks' business card site
│   ├── _mcp-sandbox/                     ← MCP write test sandbox
│   └── jpc-apc-pipeline-test/           ← Pipeline test
├── DDpro-Ops/                            ← Operations file server (MCP allowed root)
│   ├── 00-Inbox/                         ← Incoming tasks
│   ├── 10-Operations/                    ← Active ops
│   ├── 20-Projects/                      ← Project files
│   ├── 30-Content/                       ← Marketing content
│   ├── 40-Support/                       ← Support tickets
│   ├── 50-Admin/                         ← Admin records
│   └── 90-Archive/                       ← Historical files
├── DDpro-Docs/                           ← Machine documentation (MCP allowed root)
│   ├── APC-MACHINE.md                    ← THIS FILE
│   ├── Reports/                          ← Structured reports
│   │   └── System/                       ← System-level reports
│   │       └── APC_DDpro-Net-System_General_A00001
│   └── ... JPC/ (future)
├── DDpro-Sec/                            ← Secrets (NOT accessible via MCP)
│   └── mcp-local-auth/                   ← Bearer tokens per agent

9. Network Topology

                 Internet
                    │
            ┌───────▼────────┐
            │  Cloudflare     │
            │  Tunnel         │
            │  (cf-tunnel)    │
            └───────┬────────┘
                    │
            ┌───────▼────────┐
            │  Router         │
            │  10.91.137.81   │
            └───────┬────────┘
                    │ WiFi
            ┌───────▼────────┐
            │  APC            │
            │  wlp2s0         │
            │  10.91.137.9/24 │
            └───────┬────────┘
                    │ localhost
            ┌───────▼────────┐
            │  MCP Server     │
            │  127.0.0.1:3333 │
            └────────────────┘

Local: All agents on APC connect to MCP via 127.0.0.1:3333 (USB Bearer token auth)
Remote: JCodex (JPC/UK), Max and JMax (ChatGPT) connect via Cloudflare Tunnel at https://dedynamics-mcp.dedynamics.pro/mcp
Tunnel auth: Cloudflare Access service identities or OAuth

10. Security Policies

MCP Level

Native bash/write/edit blocked by MaxMem guard for all agents (bypassable via DDPRO_MAXMEM_GUARD_BYPASS=1)
run_terminal restricted to admin agent only
File writes require SHA-256 conflict guard (file must be read before write)
Path traversal protection, NUL byte rejection, symlink escape detection
Binary file content detection and rejection
Secret/key/token paths are blocked (deny-list)
Production deployments locked — no git push to any remote, no production wrangler deploys without authorization

OS Level

User aleks has full sudo access
fail2ban actively monitors SSH (TCP port 22)
clamav-daemon runs with freshclam auto-updates
rkhunter and chkrootkit run daily via systemd timers
ufw firewall installed (GUFW GUI available)
Automatic apt updates enabled (daily timer)
No crontab for user aleks (all scheduling via systemd timers)
SSH authorized_keys file is empty (no remote SSH keys configured)
Only local access and Cloudflare Tunnel used for remote

11. Backup System

Location	Path	Schedule
Weekly archive	`/mnt/ddpro-data/BACKUP/.DDpro-Company-System-YYYY-MM-DD/`	Manual (triggered by command)
Script	`/mnt/ddpro-data/BACKUP/auto-backup.sh`	(Linux backup engine)
Procedure	`/mnt/ddpro-data/BACKUP/RUN-BACKUP.md`	Manual trigger documentation

Trigger phrase: "Execute a manual global backup", "Run the backup", etc.

12. Cloudflare Resources

Resource	URL	Type
MCP Tunnel	`https://dedynamics-mcp.dedynamics.pro/mcp`	Cloudflare Tunnel
Mapper+ Production	`https://mapper-plus.dedynamics.pro`	Pages project
Mapper+ API Production	`https://api-plus.dedynamics.pro`	Worker
Mapper+ API Preview	`https://amethyst-plus-worker-preview.ddpro.workers.dev`	Worker (preview)
Admin Center	(Pages project)	ddpro-admin-center
Session API	(Worker)	amethyst-sessions
Aleks Business Card	(Pages project)	aleks-business-card

Agent Cloudflare API keys stored at: /mnt/ddpro-data/AGENTS/.secrets/cf/

13. Documentation Structure & Update Policy

Documentation tree

All system documentation lives under /mnt/ddpro-data/DDpro-Docs/:

File	Purpose	Versions
`APC-MACHINE.md`	APC hardware, software, MCP, launch commands	v1.1+
`DDpro-NET.md`	DDpro-Net system architecture, agents, security	v1.0+
`Reports/System/`	Point-in-time system reports (A-prefixed IDs)	A00001+

Update policy

Any agent that modifies infrastructure, configuration, launch scripts, or any system component MUST:

Update the relevant documentation file(s) immediately after the change
Add an entry to the change log with a version bump
Include the documentation update in the task's final report with format:
Docs updated: FILENAME.md vX.Y → vX.Z — summary of changes
Cross-reference between APC-MACHINE.md and DDpro-NET.md when changes affect both

All documentation files follow the same structure: version header, change log table, numbered sections, tables for structured data, and an end marker.

Cross-references

DDpro-NET.md details the DDpro-Net system architecture, agent identities, scopes, MCP server, security model, and Cloudflare infrastructure
APC-MACHINE.md details the physical APC workstation, its software stack, and launch commands
System reports (Reports/System/) capture point-in-time hardware/software state

14. Known Constraints & Notes

MCP server is not a git repo — source at dedynamics-local-mcp/ has no .git; deployment is at /opt/dedynamics/ddpro-mcp/current/
Device-mapper-multipathd is active but unused (single disk)
MTP mode from Samsung phone is available but not in active use
USB OMax drive is ext4 formatted (not NTFS) and is the transit vehicle for identity + release
DeDynamics external SSD is NTFS — used as bulk storage / legacy archive
WireGuard / VPN is handled through Proton VPN (split tunneling)
No monitoring/alerting currently configured — dashboard was planned but not deployed

15. Quick-Reference Launch Commands

Standard OpenCode (with MaxMem guard)

bash

opencode

Use this for normal DDpro-Git operations. The guard enforces MCP tool usage — native bash/write/edit are blocked. This is the default and preferred mode.

Bypass Mode (MaxMem guard disabled)

bash

opencode-bypass

Launches OpenCode with DDPRO_MAXMEM_GUARD_BYPASS=1 and DDPRO_MAXMEM_CALLS=200 hardcoded. Use when you need native bash/write/edit access (creating files outside MCP roots, system administration, bulk operations).

Caution: Bypass mode disables the guard that prevents accidental native-tool usage. Only use when you explicitly need it.

Script location: /home/aleks/.local/bin/opencode-bypass

Definition:

bash

#!/bin/bash
# OpenCode bypass launcher — hardcodes DDPRO_MAXMEM_GUARD_BYPASS=1
export DDPRO_MAXMEM_GUARD_BYPASS=1
export DDPRO_MAXMEM_CALLS=200
exec /home/aleks/.opencode/bin/opencode "$@"

God Clearance Mode (full admin authority)

bash

opencode-god

Launches OpenCode with:

DDPRO_MAXMEM_GUARD_BYPASS=1 (bypass MaxMem guard)
DDPRO_MAXMEM_CALLS=200 (extended call limit)
admin agent identity (full MCP scope: repo writes, commits, ops writes, docs writes)
admin Bearer token from /mnt/ddpro-data/DDpro-Sec/mcp-local-auth/client-tokens/agent-admin.token

This grants the broadest possible agent permissions on APC. The script generates a temporary OpenCode config with the admin MCP identity and auto-removes it on exit.

Use cases: MCP server maintenance, system administration, creating DDpro-Docs files, any task where the standard omax identity is too restricted.

Script location: /home/aleks/.local/bin/opencode-god

Definition:

bash

#!/bin/bash
# OpenCode God Clearance launcher
GOD_CONFIG=$(mktemp /tmp/opencode-god-XXXXXX.jsonc)
trap "rm -f \"$GOD_CONFIG\"" EXIT

cat > "$GOD_CONFIG" << 'JSON'
{
  "$schema": "https://opencode.ai/config.json",
  "plugin": [
    "opencode-supermemory",
    "/mnt/ddpro-data/DDpro-Env/plugins/memory.mjs",
    "/mnt/ddpro-data/DDpro-Env/plugins/maxmem-guard.mjs"
  ],
  "skills": {
    "paths": [
      "/mnt/ddpro-data/DDpro-Env/.agents/skills",
      "/mnt/ddpro-data/DDpro-Env/skills"
    ]
  },
  "instructions": ["/mnt/ddpro-data/DDpro-Git/AGENTS.md"],
  "mcp": {
    "dedynamics-apc": {
      "type": "remote",
      "url": "http://127.0.0.1:3333/mcp",
      "enabled": true,
      "headers": {
        "Authorization": "Bearer {file:/mnt/ddpro-data/DDpro-Sec/mcp-local-auth/client-tokens/agent-admin.token}",
        "X-Dedynamics-Agent": "admin"
      }
    },
    "dedynamics-apc-tunnel": {
      "type": "remote",
      "url": "https://dedynamics-mcp.dedynamics.pro/mcp",
      "enabled": false,
      "headers": {
        "CF-Access-Client-Id": "{file:/mnt/ddpro-data/AGENTS/.secrets/cf/admin-client-id.txt}",
        "CF-Access-Client-Secret": "{file:/mnt/ddpro-data/AGENTS/.secrets/cf/admin-client-secret.txt}",
        "X-Dedynamics-Agent": "admin"
      }
    }
  }
}
JSON

export DDPRO_MAXMEM_GUARD_BYPASS=1
export DDPRO_MAXMEM_CALLS=200
export OPENCODE_CONFIG="$GOD_CONFIG"
exec /home/aleks/.opencode/bin/opencode "$@"

Session Restart After Mode Switch

When you switch between standard, bypass, and god modes, you are starting a new OpenCode process. Each process maintains its own MaxMem session. Always call session_start(task=...) on the new process to register with MaxMem.

Quick Reference

Command	Identity	Guard	MaxMem calls	Scope	Use Case
`opencode`	omax	Active	50 (default)	DDpro-Git read/write	Normal DDpro-Git work
`opencode-bypass`	omax	Bypassed	200	Same + native tools	Files outside MCP roots
`opencode-god`	admin	Bypassed	200	Full: repo, ops, docs, commits	System admin, MCP maintenance

End of APC-MACHINE.md v1.1

APC Workstation — Complete Machine Documentation ​

Change Log ​

1. Overview ​

2. Hardware Specifications ​

System ​

Storage ​

Networking ​

USB & Peripherals ​

3. Operating System ​

OS Details ​

State ​

4. DDpro-Net — The Central Agentic Harness ​

DDpro-Net Architecture ​

Key Paths ​

MCP Server Details ​

Allowed MCP Roots (controlled by server config) ​

Forbidden MCP Operations ​

5. Agent Ecosystem ​

Human Operators ​

Production Agents ​

Preview / Remote Agents ​

Agent Memory Usage (MaxMem) ​

6. Running System Services ​

DeDynamics Core Services ​

Security Services ​

Desktop Services ​

7. Software & Development Tooling ​

Core Engineering ​

IDEs & Desktop Tools ​

Productivity ​

Utilities ​

8. Storage Layout — Mapped ​

9. Network Topology ​

10. Security Policies ​

MCP Level ​

OS Level ​

11. Backup System ​

12. Cloudflare Resources ​

13. Documentation Structure & Update Policy ​

Documentation tree ​

Update policy ​

Cross-references ​

14. Known Constraints & Notes ​

15. Quick-Reference Launch Commands ​

Standard OpenCode (with MaxMem guard) ​

Bypass Mode (MaxMem guard disabled) ​

God Clearance Mode (full admin authority) ​

Session Restart After Mode Switch ​

Quick Reference ​

APC Workstation — Complete Machine Documentation

Change Log

1. Overview

2. Hardware Specifications

System

Storage

Networking

USB & Peripherals

3. Operating System

OS Details

State

4. DDpro-Net — The Central Agentic Harness

DDpro-Net Architecture

Key Paths

MCP Server Details

Allowed MCP Roots (controlled by server config)

Forbidden MCP Operations

5. Agent Ecosystem

Human Operators

Production Agents

Preview / Remote Agents

Agent Memory Usage (MaxMem)

6. Running System Services

DeDynamics Core Services

Security Services

Desktop Services

7. Software & Development Tooling

Core Engineering

IDEs & Desktop Tools

Productivity

Utilities

8. Storage Layout — Mapped

9. Network Topology

10. Security Policies

MCP Level

OS Level

11. Backup System

12. Cloudflare Resources

13. Documentation Structure & Update Policy

Documentation tree

Update policy

Cross-references

14. Known Constraints & Notes

15. Quick-Reference Launch Commands

Standard OpenCode (with MaxMem guard)

Bypass Mode (MaxMem guard disabled)

God Clearance Mode (full admin authority)

Session Restart After Mode Switch

Quick Reference