A2AC Workspace — Forever Agents for Your IDE

Your security-first control plane for AI agents in Visual Studio Code, Cursor, and Antigravity.

A2AC Workspace is the IDE surface of the A2AC AI Forever Agents platform. Each project folder becomes a containment zone with hard security boundaries, every action produces a tamper-evident receipt, and provider failover happens automatically — all the way down to fully local models when the cloud is unreachable. From initializing a workspace to deploying cloud infrastructure, this extension brings the full A2AC platform into your IDE.

Key Features

• Agentic Chat (Ctrl+Shift+A): A full chat panel with a real tool loop — file operations, background jobs, code search, and the complete A2AC protocol toolset (tasks, receipts, audits, service status). Pick your model; Fable 5 is the default.
• Agent Carousel: Automatic failover between Claude, Gemini, Codex, and local Ollama. When one provider is offline or rate-limited, the carousel moves to the next without losing context.
• Local Sovereign Mode: When every cloud provider is down, the carousel drops to local Ollama models for fully offline, zero-token operation. No API keys, no network, no data leaving the machine.
• Runtime Chain: The extension handshakes with the A2AC runtime on activation and exposes A2AC: Preflight to verify the /api/v1 chain end-to-end, authenticated with your a2ac_ API key.
• Folder Containment: Each workspace is a security boundary. Agents cannot read, write, or execute outside their assigned directory. Cross-workspace access is blocked by default.
• Cube-v2 Receipts: Every agent action produces a SHA-256 hash-chained, tamper-evident receipt; queue envelopes are additionally signed. Click any .cube file in the sidebar to view the full audit trail.
• MCP Server: A dependency-free Model Context Protocol stdio server exposes workspace tools to any MCP-compatible client.
• Execute Task: Type a task, click Run. The carousel selects the best available provider and executes inside the contained workspace.
• Chimera Browser Agent: Launch a CDP-controlled browser session with receipts for every page interaction, form submission, and navigation.
• GCP Admin: Provision APIs, IAM, secrets, Firestore, and budget alerts for your Google Cloud project without leaving the editor.
• Brain Search: Search Q-Memory and cube evidence across all workspaces instantly.
• Boot Sequence (StartQ): A 6-gate environment check runs on activation, verifying Python, gcloud, brain connectivity, trust registry, and gateway health.
• GPU on Demand: Toggle an NVIDIA A100 (80GB) VM for training and inference workloads with a single click.

Getting Started

1. Install: Install the A2AC Workspace extension from the VS Code Marketplace or load the VSIX file manually.
2. Sign In: Authenticate with Google Cloud by running gcloud auth login in your terminal. The boot sequence verifies your credentials automatically.
3. Initialize: Open a folder, then run A2AC: Initialize Contained Workspace from the Command Palette. This creates your ai-agent.json manifest and folder structure, and your workspace is live.

Core Workflows

The Init, Setup, Run, Verify Cycle

The heart of A2AC is a four-step cycle, fully supported within the extension.

1. Init: Create a contained workspace. The extension generates ai-agent.json, the folder structure, and provider configuration.
2. Setup: Click "Setup" in the GCP Admin section to provision your cloud project: APIs, service accounts, secrets, Firestore, and budget alerts.
3. Run: Type a task in the Execute Task input and click Run. The carousel picks the best provider, signs a Cube-v2 envelope, and executes the task inside the containment boundary.
4. Verify: Check results in the sidebar Receipts view, or click "Status" in GCP Admin to verify all cloud resources are healthy.

Managing the Agent Carousel

The carousel is automatic, but you control which providers are available.

• Enable/Disable: Edit the providers section of ai-agent.json to toggle providers on or off.
• Failover Order: Claude, Gemini, Codex, Ollama. If the first provider fails, the carousel moves to the next.
• Zero-Token Mode: Enable Ollama for fully local inference at zero cost. No API keys, no network, no token charges.
• Receipts: Every carousel execution produces a receipt showing which provider was used, the task, the result, and the envelope hash. Receipts are content-addressed and append-only — execution history can't be silently rewritten.

GCP Infrastructure

Manage your Google Cloud project without switching to the console.

• Create: Enter a project name and click Create to scaffold a new contained workspace with cloud integration.
• Setup: Provision all required GCP resources in one click: APIs, IAM roles, Artifact Registry, Secret Manager, Firestore, and budget alerts.
• Status: Verify that all resources are healthy and correctly configured.
• Costs: Estimate your monthly cloud spend based on deployed services.

User Interface Overview

Sidebar (A2AC Shield Icon in Activity Bar)

This is your always-visible status display. It shows three tree views:

• Containment: Workspace ID, security boundary level, cross-workspace access policy, and allowed tools. Populated automatically from ai-agent.json.
• Agent Carousel: Which providers are enabled and their current mode. A green check means the provider is active.
• Receipts: The 20 most recent .cube and .json receipt files from the evidence/receipts/ directory. Click any file to open it in the editor.

Status Bar (Bottom of Editor)

Three items visible at all times:

• $(shield) A2AC - click to open the Control Plane panel
• $(play) provider-name - the currently active carousel provider
• $(lock) Contained: workspace-id - the containment status of the open folder

Control Plane Panel

Opened via the status bar or Command Palette. Contains the four working agents (Execute Task, Chimera, GCP Admin, Brain Search), the A100 GPU toggle, and the collapsible Infrastructure section for managing 7 Cloud Run services.

Boot Console

Runs automatically on activation. Six gates verify your environment before the workspace becomes active. A green "READY" banner means all gates passed. A yellow "DEGRADED" banner means some cloud features are unavailable but local mode works.

Prerequisites

• Visual Studio Code 1.85.0+, Cursor 1.85.0+, or Antigravity 1.85.0+
• Python 3.10+
• Git 2.30+
• Google Cloud SDK (gcloud CLI) for GCP features
• Ollama (optional) for zero-token local inference

Configuration

The extension reads ai-agent.json from the workspace root. Example:

{
  "workspace_id": "security-audit-demo",
  "security_boundary": "strict",
  "containment": {
    "cross_workspace_access": "blocked",
    "allowed_tools": ["filesystem.read", "filesystem.write", "gcp.deploy"]
  },
  "providers": {
    "codex": { "enabled": true, "mode": "terminal" },
    "antigravity": { "enabled": true, "mode": "task_queue" },
    "gcp": { "enabled": true, "mode": "cloud-run-or-gke" },
    "claude": { "enabled": false },
    "github": { "enabled": false }
  }
}

Field	Required	Description
workspace_id	Yes	Unique identifier for the workspace
security_boundary	No	strict (default) or permissive
containment.cross_workspace_access	No	blocked (default) or allowed
containment.allowed_tools	No	List of permitted agent tools
providers	Yes	Provider configuration with enabled/disabled flags

Commands

Command	Description
A2AC: Open Chat (Ctrl+Shift+A)	Open the agentic chat panel with full tool loop
A2AC: Open Mission Control	Open the Control Plane panel
A2AC: Initialize Contained Workspace	Create ai-agent.json and folder structure
A2AC: Connect Runtime (Handshake)	Authenticate against the A2AC runtime chain
A2AC: Preflight (Runtime Chain)	Verify the /api/v1 chain end-to-end
A2AC: Deploy Agent	Deploy agents to Cloud Run
A2AC: Open Ledger Explorer	Browse the full receipt ledger
A2AC: Open Web Builder	Preview, screenshot, audit, and deploy websites
A2AC: Open MCP Server Config	Configure the Model Context Protocol server
A2AC: Launch Chimera Browser	Start a CDP browser session
A2AC: Toggle A100 GPU	Power on/off the A100 VM
A2AC: Open Evidence Stream	View the output channel

Extension Settings

Setting	Description
a2ac.apiKey	A2AC runtime API key (a2ac_live_... or a2ac_test_...). Falls back to the A2AC_API_KEY env var.
a2ac.runtimeUrl	A2AC runtime chain base URL.
a2ac.gcpProjectId	GCP project for Cloud Run deployments and infrastructure.
a2ac.gcpRegion	GCP region for deployments (default us-central1).
a2ac.budgetLimit	Monthly budget limit in USD.
a2ac.containmentMode	Default containment mode: strict or permissive.

Troubleshooting

Problem	Solution
BOOTLOADER gate fails	Run gcloud auth login and gcloud config set project YOUR_PROJECT_ID
POST gate shows "Brain offline"	Expected if brain service is not deployed. Local mode works without it.
Execute Task returns no result	Check that agent_carousel.py exists and at least one provider has valid credentials
GCP Admin shows permission errors	Verify you have Owner or Editor role on the GCP project
Chimera not launching	Verify Chrome/Chromium is installed and the Chimera script path is accessible

For detailed error logs, open the Output panel (Ctrl+Shift+U) and select "A2AC" from the dropdown.

Feedback and Support

For bugs, feature requests, or support, visit github.com/A2AC/a2ac-workspace or contact the A2AC team.

(c) 2025 A2AC AI. All rights reserved.