OPEN DESIGN · DECK · OPEN-SLIDE CANVAS SEA INDIGO №01 / 10

Decision Needed — RFC-014

Local daemon
architecture: lock it,
or keep it open?

This review recommends freezing the daemon + agent-runtime data boundary before v1.0 GA. Staff eng, tech leads, and security sign off below.

OPEN DESIGN · DECK · OPEN-SLIDE CANVAS SEA INDIGO №02 / 10

The Problem

Three teams.
Three runtimes.
Zero agreement.

OPEN DESIGN · DECK · OPEN-SLIDE CANVAS SEA INDIGO №03 / 10

Part 01 — The Pain

DRIFT.

What happens when every surface guesses its own data root.

OPEN DESIGN · DECK · OPEN-SLIDE CANVAS SEA INDIGO №04 / 10

Incident History

6 sidecar identity clashes this quarter

3 of 6 traced to a runtime writing outside RUNTIME_DATA_DIR — root cause, not symptom.

OPEN DESIGN · DECK · OPEN-SLIDE CANVAS SEA INDIGO №05 / 10

Options On The Table

A

status quo

Each app resolves OD_DATA_DIR itself. Fast to ship, impossible to audit.

B

shared config file

One JSON on disk every app reads. Removes drift but adds a second source of truth.

C

daemon-resolved root

server.ts resolves OD_DATA_DIR once into RUNTIME_DATA_DIR; every path derives from it.

OPEN DESIGN · DECK · OPEN-SLIDE CANVAS SEA INDIGO №06 / 10

The Tradeoff

Shared config file (Option B)

2 wk

ship time, new failure mode

→

Daemon-resolved root (Option C)

5 wk

one truth source, harder to bypass

2wk → 5wk (+3wk) · PAY THE MIGRATION ONCE, NOT PER INCIDENT

OPEN DESIGN · DECK · OPEN-SLIDE CANVAS SEA INDIGO №07 / 10

The Recommendation

01 · RESOLVE

server.ts owns it

OD_DATA_DIR is read exactly once, at daemon startup, into RUNTIME_DATA_DIR.

02 · DERIVE

Every path descends

PROJECTS_DIR, ARTIFACTS_DIR, SQLite, MCP tokens — all constants of RUNTIME_DATA_DIR.

03 · INHERIT

Agents don't guess

Subprocesses receive the resolved root as OD_DATA_DIR; adapters stop inventing their own.

OPEN DESIGN · DECK · OPEN-SLIDE CANVAS SEA INDIGO №08 / 10

“

If a change needs a data-path rule not covered here, request a core-maintainer decision — don't invent a new convention.

— Architecture review · daemon data directory contract, decision record

OPEN DESIGN · DECK · OPEN-SLIDE CANVAS SEA INDIGO №09 / 10

Lock these four, nothing else.

01 Single root RUNTIME_DATA_DIR is the only daemon data-root truth source — no exceptions.
02 Named exceptions only OD_MEDIA_CONFIG_DIR and OD_LEGACY_DATA_DIR are the sole sanctioned overrides.
03 Inherited, not inferred Agent subprocesses receive OD_DATA_DIR from the daemon; they never resolve their own.
04 Escape hatches banned Cwd-relative defaults and per-adapter data-root helpers are blocked in review, not just noted.

OPEN DESIGN · DECK · OPEN-SLIDE CANVAS SEA INDIGO №10 / 10

Closing

Run it tonight.

Star & fork

github.com/nexu-io/open-design

Community

discord.gg/mHAjSMV6gz

Updates

x.com/nexudotio