The AI Administrator

The AI Administrator — the AI Harness — is what makes FrontierStack more than a control panel. It is a tool-using assistant with a live, accurate picture of your setup. You describe a problem in plain English; it investigates with read-only diagnostics, explains what it found, and proposes a fix that you approve before anything runs. It works on this Mac and on every server you have linked over SSH, and it never sees your passwords. This chapter explains how it thinks, what it can do, and how to keep it safe.

13.1Choosing a model

The Administrator is not tied to one vendor. At the top of the pane you choose the model that drives it:

• FrontierStack AI — the default Harness engine when its zero-retention service is available. It needs no API key of your own and runs Qwen3 through Enfour's AI Cloud. Use of FrontierStack's AI servers is free for users for now and may become a paid service later. The upstream key and provider endpoint stay on Enfour's server; prompts are deterministically redacted before upload and the service must attest zero retention. Because this final Harness engine is already zero-retention, FrontierStack skips the separate cloud Prompt Firewall pass instead of sending the same text twice. Tool restrictions and approvals remain unchanged.
• A cloud model — the most capable option for hard diagnosis and multi-step work. You supply an API key (stored locally).
• Your AI subscription via VibeProxy — the recommended route if you already pay for Claude Pro/Max, ChatGPT Plus/Pro, Gemini, Kimi, Qwen or GitHub Copilot. VibeProxy bridges those subscriptions to the harness, so the same frontier models answer with no per-token bill — a metered API key charges for every request, while a subscription you already own costs nothing extra. Install it from the VibeProxy pane (Chapter 15); if it stops, the harness falls back to another engine automatically.
• A local model — Ollama, LM Studio, or any OpenAI-compatible server on your Mac (LocalAI, Jan, llama.cpp), plus Apple Intelligence: the on-device Foundation Model on Apple silicon with macOS 26, used natively or via Apfel (a one-command install the AI Models pane sets up, runs, and can start at login or app launch for you). Local models keep work entirely offline — nothing leaves the Mac, so the pre-send screening below isn't needed and is hidden. See Chapter 15 for running local models.
• Your own subscription tool over MCP — drive the whole app from Claude Code, Claude Desktop or Cursor on the flat plan you already pay for, with no per-token bill. This is covered in Chapter 14.

13.2Let a vision model inspect a pane

When a setting is visible in FrontierStack but the Administrator's tools cannot inspect that control, click Attach Screenshot… above the prompt. This is a model capability, not a Qwen-only feature: FrontierStack sends the appropriate image format to compatible OpenAI-style, Anthropic and local Ollama vision models. A custom or routed model whose capability is unknown can be tried, although its server may reject the image.

FrontierStack never captures your screen automatically. You select one image and review the exact prepared preview. The app limits it to 1,800 pixels, strips metadata by re-rendering it, and uses macOS text recognition locally to black out lines containing known stored credentials, personal account names, private fleet identities or secret-like tokens. OCR is defence in depth, not a guarantee: crop to the relevant pane and check the preview before sending.

13.3How a conversation works

You type a request the way you would brief a colleague — “why is the site throwing 502s?”, “check whether the certificate on shop.example.com is about to expire”, “restart Postgres on db-02”. The Administrator then works in a loop:

1. It grounds itself. Before acting it discovers what you actually run — the service catalog, your linked servers and devices, the current health board — so its answers match your machine, not a generic guess.
2. It investigates read-only. It reads logs, runs diagnostics, checks ports and certificates, and inspects config files. None of this changes anything.
3. It explains, then proposes. It tells you what it found and, if a change is needed, shows the exact command or file edit it wants to run.
4. You approve. Nothing that changes the system runs until you click approve on that specific action. It then runs the fix and re-checks to confirm.

13.4The trust model: read-only by default

This is the most important section in the chapter. The Administrator is built so you can hand it production servers without losing control.

Two principles sit on top of these toggles:

• Per-action approval. Even with changes enabled, every mutating step is shown to you first — the actual command or diff — and nothing runs until you approve that action. There is no “approve everything” mode for ad-hoc changes.
• Remote actions need their own consent. Controlling a linked server through its monitoring helper additionally requires that server's own “Allow actions” switch, set in its Host Monitor pane (Chapter 8).
• Destructive database actions need a high-end model. Repairing, restoring or rebuilding a database is irreversible enough that FrontierStack hard-gates those steps to a frontier model — a small or on-device model can still read the log and diagnose, but is refused the destructive tool until you switch to a capable model (Claude Opus/Sonnet, GPT-4o/o-series, Gemini Pro).

13.5The secrets vault

Real administration needs credentials — a database password, an SSH sudo password, a Cloudflare token. FrontierStack keeps these in a local .env vault so the model never sees them.

You add named secrets in the Administrator's Script secrets (.env) bar — for example DB_PASSWORD, CF_TOKEN, SSH_SUDO_PASS. When the assistant writes a script that needs one, it references the name, not the value:

mysql -u root -p"$DB_PASSWORD" -e "SHOW DATABASES;"

At run time the app injects the real value as an environment variable — locally, or over SSH on the target server — and injects only the names a script actually references. The model is told the secret names (so it can write correct scripts) but never the values, and command output is secret-redacted before it is sent.

• Shell: $NAME / "$NAME"
• PHP: getenv('NAME')
• Python: os.environ['NAME']

13.6Prompt Firewall

Prompt Firewall is an optional semantic check on top of FrontierStack's always-on deterministic redaction. Choose On this Mac to use an Ollama or supported local OpenAI-compatible model, or explicitly choose Enfour's AI Cloud. It can warn and ask, automatically redact what it finds, or block the send.

On-device screening keeps the check entirely on this Mac. Enfour's AI Cloud receives only text after FrontierStack has removed known credentials, usernames, private addresses and secret-shaped patterns. It is free for users for now. The cloud service must attest zero retention on every response; if that assurance or the service disappears, screening returns an unverified result and Block mode stops the send. Enfour's upstream provider key and endpoint never reach the app, allowing Enfour to change the trusted provider later without distributing a new key or remotely configuring the app to call an arbitrary address.

13.7What the Administrator can do: the tools

The assistant acts only through a fixed set of audited tools. Each is guard-railed: read-only tools always work; mutating tools need the toggles above and an approval. Grouped by job:

The general-purpose run_script tool is the assistant's shell: anything the fixed tools do not cover, it does by writing a small, readable script and showing it to you for approval. On a remote server it works in two passes — a read-only test script to find the problem, then a minimal fix, then a re-test to confirm.

13.8Skills, notes and memory

Three features let the Administrator work from your knowledge rather than generic defaults.

13.11.1Skills

Skills are curated, multi-step playbooks — a fleet security audit, a web-stack restart procedure — managed in the AI Skill Manager. The assistant lists them cheaply (names only) and loads one's full instructions on demand, so a task follows your approved procedure instead of improvising.

13.11.2Notes shared with the AI

The Notes pane (Chapter 3) holds credentials, runbooks and instructions, each behind a per-note lock that is off by default. The assistant can read only the notes you have explicitly unlocked with Share with AI; it sees their titles to know what exists, and reads a body only when a task needs it.

13.11.3Long-term memory

Tell the assistant “remember that LINE is my preferred channel” or “never send messages on weekends” and it saves the rule to a durable memory.md so it honours it in future sessions. You can list and forget memories at any time.

13.9This Mac and your fleet

Almost every tool takes a target. Omit it and the tool runs on this Mac; set it to a linked server's name and the same diagnostic, log read, script or fix runs there over SSH (read-only tools stay read-only). So the same conversation can move fluidly from “check this Mac’s disk” to “now do the same on web-01 and edge-03”. Linking servers and the host-monitor helper are covered in Chapter 8.

Before privileged work, the harness reads a non-secret access status for the selected target. A linked server reports whether its SSH/root/sudo password is saved locally in FrontierStack's Keychain; only the fact that access is available reaches the model, never the value. This Mac reports whether the approved privileged helper is ready or whether a supported action will show the normal interactive macOS administrator-password prompt. When access is available, the assistant should try the bounded tool after your approval instead of stopping at instructions. Free-form AI scripts are not automatically given a server's saved password.

13.10Custom instructions and history

The Custom Instructions editor (Chapter 17) lets you shape the assistant's standing behaviour — house style, what to summarise, defaults you always want. Past conversations are kept in the history menu so you can return to an investigation, and the assistant can pick up where it left off.

13.11A worked example

To see the pieces together, here is a typical exchange — “the shop is down with 502s.”

The assistant calls get_server_health and sees Apache up but PHP-FPM down on web-01. It reads the PHP-FPM log with read_logs (target web-01) and finds the pool failing to start after a config edit. It shows you the offending lines, proposes a one-line fix to www.conf via write_remote_file, and — once you approve — reloads with reload_webserver and re-checks the site over loopback. Green. If you ask, it sends a one-line all-clear to your team with send_notification.

Throughout, no password reached the model, every change waited for your approval, and the whole thing is something you could have done by hand — just faster.