Roadmap architecture · not yet available

Gajae Remote

Gajae Remote is a proposed thin phone steering wheel for already-running PC-side gjc sessions. It is not a shipped product surface: there is no released gateway, pairing flow, mobile client, TLS endpoint, bearer token, or remote:* scope to configure today.

Target authority boundary

Design target, not a current guarantee: the PC would remain authoritative. The proposed phone companion would observe bounded state and submit one-line instructions only; it would not become a shell, file editor, remote desktop, SDK WebSocket client, or Coordinator MCP controller.

The proposed boundary keeps file edits, shell execution, workflow-gate answers, approval prompts, raw transcripts, tool arguments/results, diffs, secrets, environment, and system prompts on the PC. No runtime currently enforces this proposed remote boundary.

Proposed gateway-only scopes

The planned gateway would be separate from Bridge mode, the per-session SDK WebSocket, Coordinator MCP, and ACP. TLS, bearer authentication, fail-closed behavior, and the following scopes are architecture targets rather than live security properties:

remote:view for bounded views.
remote:submit for one-line submission through the owner submit path.
No scope would authorize raw session reads, session creation or switching, branching, model changes, shell or host control, or administrative surfaces.

Proposed transmitted-data allowlist

The design would expose only a typed projection: session summaries with sessionId, a sanitized derived name, harness, status, last activity, and branch; and bounded open-session lifecycle, liveness, blockers, signals, git-delta/risk enums, and submit readiness.

Raw pane output, full transcript/message bodies, tool args/results, file contents, diffs, system prompt, env, tokens, secrets, and absolute paths would be withheld by default. These are intended requirements, not implemented filtering guarantees.

Planned architecture and failure behavior

The proposed PC-side gateway would enumerate harness control-plane state, observe each owner through bounded control-plane data, and proxy one-line submits through the local owner submit path. A mobile-web client is the first target; a hosted relay is deferred pending separate trust-model review.

The design calls for disabled submit when the owner is offline or busy, re-pairing after revoked credentials, typed authorization errors such as scope_denied, and a neutral “withheld on PC” marker. Do not depend on these behaviors until Gajae Remote ships with documented configuration and release notes.