DDpro-Net — Agentic Application Harness

Document version: 1.2 Last updated: 2026-07-29 Author: OMax Classification: Internal DeDynamics — System Reference

Change Log

Version	Date	Author	Changes
1.0	2026-07-29	OMax	Initial system documentation
1.1	2026-07-29	OMax	Added docs site URL; VitePress docs site deployed to Cloudflare Pages; Cloudflare MCP servers added to opencode-god config
1.2	2026-07-29	OMax	Added DOCS-FLOW.md — human-to-agent documentation workflow; docs-publish skill; escrow template; Cloudflare Access app for docs.dedynamics.pro

1. Overview

DDpro-Net is the DeDynamics agentic application harness — a multi-agent system running on APC (Ubuntu 26.04) that provides MCP-based tool access, persistent memory (MaxMem), Cloudflare tunnel connectivity, and coordinated agent operations across all DeDynamics projects.

Key facts

Host: APC (Aleks' Primary Computer) — see APC-MACHINE.md for hardware specs
Runtime: OpenCode CLI, running inside GNOME Terminal on Ubuntu 26.04
MCP server: dedynamics-local-mcp — runs as a systemd service on port 3333
Memory layer: MaxMem — persistent agent memory via the DeDynamics MCP server
Cloudflare: Pages, Workers, D1, KV, R2 — managed via wrangler CLI per agent
Storage root: /mnt/ddpro-data/DDpro-Git/ (repos), /mnt/ddpro-data/DDpro-Docs/ (documentation), /mnt/ddpro-data/DDpro-Ops/ (operations)

2. Directory Structure

/mnt/ddpro-data/
├── DDpro-Git/                    ← All DeDynamics repositories (MCP-allowed root)
│   ├── dedynamics-local-mcp/     ← MCP server source code
│   ├── amethyst-mapper-plus/     ← Mapper+ (Amethyst Toolkit)
│   ├── ddpro-admin-center/       ← Admin Center
│   ├── amethyst-sessions/        ← Session API worker
│   ├── amtoolkit-site/           ← Amethyst Toolkit website
│   ├── AGENTS.md                 ← Master agent instructions (read by all agents)
│   └── _dd-ecosystem/            ← Ecosystem context and workflows
│
├── DDpro-Docs/                   ← System documentation (MCP-allowed root)
│   ├── APC-MACHINE.md            ← APC workstation documentation
│   ├── DDpro-NET.md              ← This file — DDpro-Net system documentation
│   └── Reports/
│       └── System/
│           └── APC_DDpro-Net-System_General_A00001  ← System report
│
├── DDpro-Ops/                    ← Operations files (shared read/write)
│   └── ...                       ← Ops docs, credentials, logs
│
├── DDpro-Env/                    ← Environment (skills, plugins, knowledge, memory)
│   ├── .agents/skills/           ← Agent skills (Cloudflare, Agents SDK, etc.)
│   ├── skills/                   ← DeDynamics-specific skills
│   ├── plugins/                  ← OpenCode plugins (memory.mjs, maxmem-guard.mjs)
│   ├── _Knowledge/               ← Company context, architecture docs
│   ├── _opencode-memory/         ← OpenCode simple memory fallback
│   └── agent-memory/             ← MaxMem JSONL stores
│
├── AGENTS/                       ← Agent configuration
│   ├── OpenCode/config/          ← OpenCode runtime configs
│   └── .secrets/                 ← Cloudflare API keys per agent
│
├── DDpro-Sec/                    ← Security files (MCP auth tokens)
│   └── mcp-local-auth/           ← Local Bearer token store
│       └── client-tokens/        ← Per-agent token files
│
├── BACKUP/                       ← Weekly system backups
│   ├── RUN-BACKUP.md             ← Backup procedure
│   └── .DDpro-Company-System-*   ← Backup snapshots
│
└── (other project dirs)

3. MCP Server

The dedynamics-local-mcp server runs as a systemd service and provides all tools for all agents.

Service management

bash

sudo systemctl status ddpro-mcp          # Check service
sudo systemctl restart ddpro-mcp         # Restart after modifications
sudo journalctl -u ddpro-mcp -n 50       # View recent logs

Source code and deployment

Source: /mnt/ddpro-data/DDpro-Git/dedynamics-local-mcp/
Build: npm run build (compiles TypeScript to dist/)
Deploy: sudo cp -r dist/* /opt/dedynamics/ddpro-mcp/current/dist/ && sudo systemctl restart ddpro-mcp
Runtime: /opt/dedynamics/ddpro-mcp/current/dist/src/server.js
Config: /etc/systemd/system/ddpro-mcp.service.d/local-creds.conf

Endpoints

Endpoint	Method	Description
`/`	GET	Server root — health summary, write state, all roots
`/health`	GET	Detailed health — auth config, OAuth status, local credentials
`/mcp`	GET	MCP SSE endpoint — agent connections
`/mcp`	POST	MCP JSON-RPC — tool calls from agents

Allowed roots

Root	Constant	Writable	Tools
`/mnt/ddpro-data/DDpro-Git`	`GIT_ROOT`	Yes	`write_file_scoped`, `patch_file_scoped`, `git_commit_files`
`/mnt/ddpro-data/DDpro-Docs`	`DOCS_ROOT`	Yes	`write_docs_file_scoped`, `patch_docs_file_scoped`
`/mnt/ddpro-data/DDpro-Ops`	`OPS_ROOT`	Yes	`operations_file_write`, `operations_directory_create`
`/mnt/ddpro-data/DDpro-Env`	`ENV_ROOT`	Read-only	`read_env_context_file`, `env_inventory`

4. Agent Identities and Scopes

Each agent has a unique MCP identity with a dedicated Bearer token and Cloudflare API key.

Agent	Token file	CF API key file	Workstation	Role
`omax`	`agent-omax.token`	`cf/omax-api-key.txt`	APC	Coordination, deploy, prompt engineering
`codex`	`agent-codex.token`	`cf/codex-api-key.txt`	APC	Implementation
`jcodex`	`agent-jcodex.token`	`cf/jcodex-api-key.txt`	Remote (JPC)	Implementation (UK)
`omaxmap`	`agent-omaxmap.token`	`cf/omaxmap-api-key.txt`	APC	Mapper+ specialist, Amethyst, Admin
`admin`	`agent-admin.token`	`cf/admin-client-id.txt` + `.secret`	APC	Full system authority (god clearance)
`pixomax`	`agent-pixomax.token`	`cf/pixomax-api-key.txt`	Pixel 7	Mobile operations

Token directory: /mnt/ddpro-data/DDpro-Sec/mcp-local-auth/client-tokens/ Cloudflare keys directory: /mnt/ddpro-data/AGENTS/.secrets/cf/

Scope levels (least to most permissive)

Level	Scopes	Agents
Standard	repo:read, repo:status, repo:diff, env:inventory, env:docs, memory:read, memory:write	jcodex
Development	+ repo:write, repo:commit (repo-write)	codex, omaxmap, omax
Operations	+ ops:write, ops:create	jcodex (ops), codex, omaxmap, omax
Documentation	+ docs:write	codex, omaxmap, omax, jcodex
Admin (god)	All above + full system access	admin

5. OpenCode Launch Modes

Three launch modes exist on APC, each serving a different purpose.

Standard mode (`opencode`)

Agent identity: omax
MaxMem guard: active
Tools: MCP tools only (native bash/write/edit blocked)
Use: normal DDpro-Git work

Bypass mode (`opencode-bypass`)

Agent identity: omax
MaxMem guard: bypassed (DDPRO_MAXMEM_GUARD_BYPASS=1)
Tools: all (native tools + MCP tools)
Use: creating files outside MCP roots, system administration

God mode (`opencode-god`)

Agent identity: admin
MaxMem guard: bypassed
Tools: all, with full write scopes (repo commits, ops writes, docs writes)
Use: MCP server maintenance, system setup, documentation creation

See APC-MACHINE.md section 14 for detailed definitions of each launcher.

6. MaxMem Agent Memory

MaxMem is the shared memory system that all DeDynamics agents use for coordination, handoffs, and persistent state.

Memory stores

Store	Visibility	Purpose
`my_memory_store`	Private (per agent)	Decisions, architecture, task state, handoffs
`shared_memory_store`	All agents	Cross-agent coordination, blockers, milestones
`worklog_store`	All agents	Detailed task timeline (auto-logged + manual)

Session protocol

Every agent session follows this flow:

session_start → shared_memory_feed → work_claims_list
→ agent_questions_list → work → my_memory_store
→ worklog_store → shared_memory_store
→ work_claim_release → session_end

Guard

The MaxMem guard (/mnt/ddpro-data/DDpro-Env/plugins/maxmem-guard.mjs) enforces:

Session must be started before any tool call
Manual log every N tool calls (default: 50, configurable via DDPRO_MAXMEM_CALLS)
Task-start entry before mutation tools
Session end with handoff or session is non-compliant

7. Cloudflare Infrastructure

All DeDynamics projects run on Cloudflare Pages and Workers. Each agent has its own Cloudflare API key for preview deployments.

Projects

Project	Type	Production URL	Repo
Amethyst Mapper+	Pages + Worker	`https://mapper-plus.dedynamics.pro`	`amethyst-mapper-plus/`
Admin Center	Pages + Functions	`https://admin.dedynamics.pro`	`ddpro-admin-center/`
Amethyst Toolkit	Pages	`https://amtoolkit.dedynamics.pro`	`amtoolkit-site/`
Session API	Worker	`https://sessions.dedynamics.pro`	`amethyst-sessions/`
MCP Tunnel	Worker	`https://dedynamics-mcp.dedynamics.pro`	(Part of `dedynamics-local-mcp/`)

Deployment rules

Preview deploys: agent may deploy to Cloudflare Preview via wrangler CLI (own API key)
Production deploys: locked — only with explicit Aleks authorization
Sandbox services allowed (Paddle sandbox, preview D1, preview KV)
Live Paddle values, production secrets, production D1/KV/R2: forbidden without authorization

8. Documentation Standards

All DDpro-Net documentation follows the same structure:

Required elements

Header: Title, version, date, author, classification
Change log: Table with version, date, author, and change description
Sections: Numbered, with clear hierarchical headings
Tables: For structured data (specs, configurations, mappings)
End marker: *End of FILENAME.md vX.X*

Update policy

Any agent that modifies infrastructure, configuration, or launch scripts MUST:

Update the relevant documentation file(s) with the change
Add an entry to the change log with version bump
Include the documentation update in the task's final report

Documentation tree

/mnt/ddpro-data/DDpro-Docs/
├── APC-MACHINE.md          ← APC hardware, software, MCP, launch commands
├── DDpro-NET.md            ← This file — DDpro-Net system architecture
├── AGENTS.md               ← (Pointer to DDpro-Git master AGENTS.md)
└── Reports/
    └── System/
        └── A*_*.md         ← System reports (incrementing A-prefixed IDs)

Cross-references

APC-MACHINE.md details the physical machine; DDpro-NET.md details the system
AGENTS.md (at DDpro-Git root) defines agent behavior; documentation here defines the infrastructure
System reports capture point-in-time machine state; documentation captures durable knowledge

9. Security Model

Authentication

Primary: Cloudflare Access OAuth (for humans via browser)
Fallback: Local Bearer tokens (for CLI agents)
Token storage: /mnt/ddpro-data/DDpro-Sec/mcp-local-auth/client-tokens/
Token format: ddsec_<base64url-random>

Authorization

Scopes are assigned per agent identity (see section 4)
All write operations require SHA-256 conflict guards (file must be read before write)
Repo commits require maxRepoWriteEnabled and aleks agent role
File deletion and secret editing are forbidden for all agents

Credential locations

Credential	Location	Access
MCP Bearer tokens	`/mnt/ddpro-data/DDpro-Sec/mcp-local-auth/client-tokens/`	Root + aleks
Cloudflare API keys	`/mnt/ddpro-data/AGENTS/.secrets/cf/`	Root + aleks
Admin CF client secret	`/mnt/ddpro-data/AGENTS/.secrets/cf/admin-client-secret.txt`	Root + aleks

10. Backup System

Full system backups are stored at /mnt/ddpro-data/BACKUP/. Procedure documented in RUN-BACKUP.md.

Schedule: Friday 16:00 (systemd timer)
Retention: Last 8 backups kept
Trigger: Any agent can be told "Run the backup"
Scope: Repos, env, memory, agent configs, docs

End of DDpro-NET.md v1.0

DDpro-Net — Agentic Application Harness ​

Change Log ​

1. Overview ​

Key facts ​

2. Directory Structure ​

3. MCP Server ​

Service management ​

Source code and deployment ​

Endpoints ​

Allowed roots ​

4. Agent Identities and Scopes ​

Scope levels (least to most permissive) ​

5. OpenCode Launch Modes ​

Standard mode (opencode) ​

Bypass mode (opencode-bypass) ​

God mode (opencode-god) ​

6. MaxMem Agent Memory ​

Memory stores ​

Session protocol ​

Guard ​

7. Cloudflare Infrastructure ​

Projects ​

Deployment rules ​

8. Documentation Standards ​

Required elements ​

Update policy ​

Documentation tree ​

Cross-references ​

9. Security Model ​

Authentication ​

Authorization ​

Credential locations ​

10. Backup System ​