An open standard for letting AI agents administer Linux safely — by never handing the agent a shell.
Instead of filtering dangerous shell commands after a model writes them, LACS gives the model no shell at all. Its only vocabulary for changing the system is a fixed, enumerated catalogue of typed actions, each with a risk level, an approval gate, and a tamper-evident audit requirement.
→ SPECIFICATION.md — version 0.1
It defines:
- Typed actions — a closed catalogue; no channel ever carries a shell string.
- Risk classification — every action is Low / Medium / High.
- Roles & authorization — Observer / Dev / Admin / Boot; the minimum role is derived from the risk level and enforced by the executor, not the agent.
- Preview → approval → execute — a change is previewed and the exact preview approved (one-time, expiring, hash-bound) before anything runs.
- Audit — every mutating action lands in an append-only, asymmetrically signed log that anyone can verify with the public key but no one can forge.
→ lacs-project/sysknife — a privileged root daemon (Rust, MIT) that turns natural-language requests into approved, audited system changes on Ubuntu and Fedora atomic hosts. Every normative requirement in the spec maps to code in that repository.
This specification is released into the public domain under CC0 1.0. Implement it, adapt it, or extend it without permission or attribution. Other implementations, for other distributions and languages, are explicitly encouraged.