# CC10 Technical Perspective

A reference architecture for sovereign, AI-assisted digital infrastructure

Language: English  
Privacy: Public, sanitized reference artifact  
Version: 2026-07-21

## 01 — Architecture starts with the exit path

CC10 is a working reference for an independent digital ecosystem, not a promise that one product solves sovereignty. The architecture begins with ownership: identity, authoritative data, configuration, operating knowledge and recovery. Components are selected behind stable interfaces so they can be replaced. Open protocols and export paths reduce lock-in, while acceptance tests prove that a documented claim still works in the running system.

## 02 — Thin clients, private core, replaceable edge

Phones and computers are thin browser clients. The private core runs identity, files, messaging, research, creation and the operator control plane. A replaceable public edge terminates TLS and hosts workloads that must remain reachable from the internet. Administration travels through an encrypted mesh instead of public management ports. Stable domains hide placement changes from users, so infrastructure can evolve without redesigning the product experience.

## 03 — One master per capability

Each capability has one authoritative data master. Files and groupware, private messages, public social posts and credentials remain separate domains with explicit exports. Applications may exchange reviewed copies, but a generated video does not silently become the source document and a social post does not become the private photo archive. This model keeps backup, retention, migration and deletion responsibilities understandable.

## 04 — Shared authentication, explicit authorization

Authentik centralizes sign-in through standard application interfaces. Authorization remains explicit: role groups bind a person to each application and stronger authentication protects sensitive functions. Closed registration reduces accidental exposure. Policy tests use both allowed and denied identities, because a successful owner login proves only the happy path. Secrets remain outside source control and public showcases use sanitized data.

## 05 — AI is an adapter — never the authority

Trusted applications call an engine-neutral adapter. The current primary path invokes an authenticated Codex session on the operator host, avoiding a separate metered API key for personal use. Local engines can replace or complement that path. Speech and rendering can remain on the platform. The adapter is not exposed as a public proxy, does not lend subscription access to arbitrary clients and never receives authority to bypass typed actions or approval policy.

## 06 — Clone, describe, plan, approve, prove

The reusable distribution separates public reference code from private inventory and secrets. An operator clones the sanitized repository and completes a system profile describing domains, hosts, storage, identity roles and desired applications. The AI bootstrap prompt first produces a plan and risk summary. A human approves the change set. Idempotent infrastructure code applies it, and acceptance tests create evidence. Prompts accelerate work; they do not replace source control, review or recovery.

## 07 — Typed operations create a safety rail

The control plane exposes typed actions instead of unrestricted remote root. Inspection can be broad and read-only. A mutation identifies the target, expected change and risk, then passes through the appropriate approval boundary. The action is designed to be idempotent. Service checks and browser workflows verify the result, and an audit entry survives the chat session. Backup and restore tests remain separate gates from uptime checks.

## 08 — Working reference today, distribution in progress

Today CC10 is a live reference implementation with verified public-edge infrastructure code, working identity, daily applications, real workflows and operating checks. The sanitized distribution, final licence and clean-room installation outside the original environment are still release gates. That distinction is intentional. Builders can study and adapt the reference now. Organizations that need migration, security hardening, governance, support or a validated enterprise deployment can engage Cong directly.