Agent-Sudo went live on both hosts tonight (005c214 in the boilerplates repo). This
records what "done" actually means and what is left, since dedicated time on this ends
today and the rest has to run via background agents.
Corrects the goal: tier 4 is human-only BY DESIGN (D-CB7) — the daemon unit env holds
SUDO_MD_VERIFY_ENFORCE, so a system that can restart its own daemon can disarm its own
gate. "Handling tier 4" means refusing it, which is done and verified. Real remaining
scope is tiers 1-3.
Records the measured Incus asymmetry (server-01 has it, primary does not), which makes
tier 2 on primary an open design question rather than a task; the tier-1 scoped-undo
defect (app.py:244 hardcodes tier 3 while REQUIRES_UNDO_TIERS is (1,3)); and the
per-host-values-in-a-shared-tracked-file bug class that bit twice in one directory.
secrets-proxy is deliberately scoped as investigate-then-plan: it exited gracefully and
nobody knows why, so S1 answers that before anyone writes S2.
Refs #128, #146, #149, #150, #173, #191, projects id=187.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
- agent_sudo_design_decisions.md: D-CB5 (3 tier-3 fails / 15min sliding / per-host),
D-CB6 (append-only breaker log, state always replayed — tamper-EVIDENT beats
tamper-PROOF when the daemon is root), D-CB7 (Set B host_override in code),
D-CB8 (which tier-4 sources latch), D-CB9 (trip escalation). Each with rationale,
rejected alternatives, and accepted costs.
- agent_prompts.md: add the P3-WIRING prompt. Flags a real NAME COLLISION — the
existing "P3" section is the OLD P3 (Vault AppRole + Timeshift + evaluator, done
as #142); P3 was redefined after D-CB1-D-CB9 were locked. Running the old one
would redo finished work. Today's inline agent prompts were never persisted, which
is why this one is.
- context.md: P3 code complete but UNDEPLOYED — the server-01 tier-0 breaker.log hole
is open in production until DEPLOY_RUNBOOK.md runs. Two verified deploy blockers
(Dockerfile never COPYs circuit_breaker.py/security/; compose has no
/var/lib/agent-sudo mount => breaker resettable by docker restart, the exact D-CB6
bypass). Both were invisible to an 85/85-green suite.
- context.md: MEMORY_DIR answered — do NOT repoint embed_memory_dir.py; its
claude_memories table has no reader. Recall corpus now includes design docs;
context.md stays excluded until #192 prunes it.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Bake-off is closed — Opus 4.8/medium is the standing default, Sonnet arms
cancelled, per-task logging retired. Cost is no longer a model-selection
input: billing is hard-capped, so Opus's real cost is Pro daily-limit hits,
an accepted trade. Max is the fix, not a downgrade.
Also adds the warning that bit twice in one session: task descriptions and
handoffs decay. #149's "delete the stale playbook" hazard was already done
the night before, and session_handoff.md had been asserting a FALSE
passwordless-sudo alarm plus a DEAD root token as live into every session
for 3 days. Check the artifact before doing the work.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
context.md is injected into every session by the session-start hook, so a
stale one silently misinforms every future conversation. This one still
described the project as N8N Agent Builder work while the actual project has
been Agent-Sudo/CA for weeks, and it survived three end-of-session checklist
runs untouched — the checklist referenced context.md in its git step but
never had a step telling anyone to update it. That gap is now closed.
Adds what the project actually is now, what is live (Agent-Sudo enforcing on
both hosts, CA hook v2.1), the production-vs-sandbox Vault tell that already
caused one near-miss, and the next-session order. Marks the June scheduled
work superseded and fences off the 568 lines of append-only history below it.
The pointer stops the file misinforming; it does not stop it costing 49KB
per session. Pruning tracked as a follow-up.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Records why the v2.0 classifier taxed the user 22 prompts and what changed.
Root cause: v2.0 conflated "contains a redirect character" with "writes
something". `2>&1` is file-descriptor plumbing and `>/dev/null` is a discard —
neither writes. That single mistake caused 16 of the 22 prompts. It was found
by reading ca_decisions.jsonl, not by inspection: the bug was the classifier's
reasoning, so re-reading the code only reproduced it.
v2.1 changes (all evidence-driven, none speculative):
- _SAFE_REDIRECT_RE strips fd plumbing + /dev/null discards before the
redirect check; a redirect to any REAL path still disqualifies, anchored so
`>/dev/nullx` cannot ride the prefix.
- `cd` added to READONLY_ALLOW (no filesystem effect; every other segment must
independently qualify anyway).
- `ssh <host> '<cmd>'` classifies the inner command under identical rules,
depth-limited to one hop.
Verified: 42/42 self-test, e2e ALL PASS, classify() median 0.011ms.
Tier-1 writes deliberately NOT shipped — widen on evidence, not guesses.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
- constrained_autonomy_design_decisions.md: D1-D8 locked (hybrid hook
classifier + Agent-Sudo daemon executor, structural classification with
unknown->sandbox, fail-closed, Hermes recovery ladder) + EXECUTION ORDER
with CA-P1a inserted as zero-dependency item 0
- agent_prompts.md shared block: replace "TIER-2 IS BROKEN" with the
corrected root cause (old primary bridge's NTFY endpoint was unreachable;
tier-2 works when the bridge reaches ntfy + user is attended)
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
- P0 build prompt now does Part A (command_audit schema) + Part B
(read-only audit of all P1-P5 assumptions) + Part C (remediate safe
findings = all of P1: Incus install, host inventories, build-sandbox.sh,
both sandbox mirrors)
- Golden Rule: only remediate read-only or server-01-sandbox findings;
tier-2/manual-auth or prod-touching → batched, never blocked
- Ends with a BUILD READINESS wrap-up so the focused build starts at P2
- P1 section retained as canonical contract reference, marked folded-in
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Agent Builder: added Step 2 (fetch required_playbooks from Gitea URLs), added
mandatory claude_agent prompt design rules to Ollama prompt (--max-turns 15,
loop detection, credential map inline, defined output), added Step 6 synchronous
human NTFY gate for claude_agent prompt review before sandbox testing.
N8N Builder: same required_playbooks fetch step, added Step 8 synchronous human
NTFY gate for any workflow containing a claude -p node.
Both changes prevent runaway token loops in built automations by ensuring every
generated claude -p call has hard stops baked in and user-reviewed before deploy.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
allowlist.json must be root-owned so POST /allowlist is the only write
path; direct file edit bypasses audit log and danger veto. No cross-
bridge sync — allowlists grow organically per server.
All prereqs confirmed live on server-01. Full automation_ideas priority reorder (p1–p17 non-blocked,
p20–p29 blocked). Added id=67 N8N Builder Agent. id=57 expanded to full production mirror scope.
June 19: manual infrastructure day (id=51 + id=57). June 22: builder agents extended session.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Initial commit tracking session context, playbooks, and automation specs
for claude-config and agent-builder Claude Code conversations.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Backtalk6858