GridWeave GridWeave
Under construction. Not released.

Manage every device from one place, and check the work yourself.

GridWeave is a remote device management platform: a Go server, a Rust agent on each device and a web application. The agent verifies every command itself before it acts, and refuses what does not check out.

Read the docs See the security model

Or look at the features, the architecture and the roadmap.

command envelope, signed by the Command CA
ok  chain and signature
ok  device and tenant
ok  two-minute validity window
ok  replay
ok  permissions named in the envelope
otherwise: refused, nothing runs
The checks the agent makes before it acts on a command.

What it does

Fleet management, built feature by feature.

Everything here is on the main branch of the product. Some parts are only partly proven; the status section below says which.

  • Multi-tenant by design

    PostgreSQL row-level security on every tenant table. Roles, allow and deny bindings, device groups and delegation rules that stop anyone granting more than they hold.

  • Signed commands

    Run a script on up to 500 devices as a job, or power, notify, wake and more. The agent checks each command before it acts.

  • Terminal and files

    A relay joins your client and the agent with signed single-use grants. Consent is asked on the device, and a revoked permission ends the session within two seconds.

  • Agent as a service

    Enrolled by token with mutual TLS and installed as a systemd unit, a LaunchDaemon or a Windows service. Proven on Ubuntu; macOS and Windows less so. It updates itself from signed manifests in staged rollouts and rolls back a build that does not come back; proven on Linux only.

  • Sign in your way

    Local accounts with TOTP, OpenID Connect, LDAP and SAML 2.0, password reset and invitations by mail, personal access tokens and the gridweave command line.

  • Runs where you do

    One Linux host with systemd, container images and Compose, or a Helm chart. S3 object storage and an OpenBao key store are options.

All features and what is proven

How it is built

One server binary, many roles, no state in the process.

The server gridweaved runs one role per service, or all roles in one process for development and small installs. State lives only in PostgreSQL, the bus and object storage, so every role can run as many copies as needed.

GridWeave architecture The web app and the gridweave command line reach the server roles API and relay over HTTPS and WebSocket. The Rust agent connects to the agent gateway over mutual TLS. The roles API, relay, agent gateway and worker share a NATS JetStream bus and use PostgreSQL and object storage. Clients and devices gridweaved roles Bus State HTTPS WebSocket mutual TLS Web appReact, in the browser gridweavecommand line gridweave-agentRust, on each device apiHTTP API and event stream relayterminal and files sessions agent-gatewaysigned commands, reports workerjobs and scheduled work NATS JetStream PostgreSQLstate, audit, outbox Object storageS3 API or local disk
Solid lines are request and event paths, dashed lines are WebSocket sessions and optional storage. The web app also uses the relay for terminal and files tabs. Two more roles exist: amt (Intel AMT, simulator only) and bridge (not built).

Read the architecture

Security

The agent does not trust the server blindly.

Authorisation is checked on the device, by the agent, for every command and every session.

  • Verified by the agent

    A command is a server-signed envelope. The agent checks chain, signature, device, tenant, time, replay and permissions before it acts, and refuses otherwise.

  • No server-supplied code

    The agent protocol has no message that delivers code to run. An operator's script travels inside a verified command, and updates are signed manifests checked against keys compiled into the agent.

  • Isolation in the database

    Tenant separation is enforced by PostgreSQL row-level security, not only by application code. Tests prove a cross-tenant read returns nothing.

  • Audit before action

    Every command is recorded before it is sent. The audit log is append-only and hash-chained, and gridweave-admin audit verify checks the chain.

The full security model

Status

Under construction, and said plainly.

Not released. Nothing is code-signed.

CI is disabled and the local checks are the gate. The Windows parts written most recently have never been run, and the Windows machine has been unreachable since. Do not use GridWeave to manage devices you depend on.

The full roadmap and known gaps

  • BuiltControl plane, agent plane, terminal and files, sign-in options, containers and a Helm chart, load and conformance tools, the redesigned web application. Proven in places, on one macOS machine and one Ubuntu virtual machine.
  • PartialRecording and guest sharing work for terminal sessions only, have not run against a real agent or browser, and the agent shows no notice yet. Staged rollouts and agent self-update with rollback are proven on Linux only; macOS and Windows are unverified. The production key store is not the default. The Helm chart is for evaluation.
  • Simulator onlyIntel AMT was tested against a simulator, never real hardware.
  • Not builtRemote desktop, desktop recording, the legacy adapter, notification delivery and passkeys.
  • Not doneCode signing, a first release, an install page.

Licence and origin

Apache-2.0, built clean-room.

GridWeave is licensed under the Apache License 2.0. It was built from a behavioural specification, feature by feature, without using code from any earlier product. Dependencies are limited to permissive licences and checked by a build step.