[2026-05-24] wiki index rebuild, autonomous-agent-safety synthesis
This commit is contained in:
Alexey Martemyanov
@@ -0,0 +1,45 @@
|
||||
---
|
||||
date: 2026-05-24
|
||||
status: complete
|
||||
---
|
||||
# Wiki Curation — 2026-05-24
|
||||
|
||||
## Done
|
||||
|
||||
- **Conflict scan:** No git conflict markers found in ~/obsidian/ ✅
|
||||
- **Previous run (2026-05-23):** Status = complete, no Unfinished section ✅
|
||||
- **Orientation:** SCHEMA.md (domain: personal KB), index.md (28 entries, bootstrapped 2026-05-23), log.md (37 lines)
|
||||
- **Vault changes since 2026-05-23 02:00:** Large batch of new pages from yesterday's wiki expansion — 17 pages existed on disk but not in index.md (see Index rebuild below)
|
||||
- **Inbox:** ~/obsidian/wiki/raw/inbox/ empty (only `processed/` subdir) ✅
|
||||
- **Sessions:** No sessions for 2026-05-24. Cron session 2026-05-23 was wiki curation itself — not crystallizable.
|
||||
- **Research queue:** Marked 2 items as completed (pages already existed): executor-orchestrator → [[concepts/executor-orchestrator]], executor-security-incident → [[concepts/executor-security-incident]]
|
||||
- **Synthesis (MANDATORY):** `concepts/autonomous-agent-safety.md` created ✅
|
||||
- Co-occurrence: executor-security-incident + executor-orchestrator + personal-os-agent-rules (3 pages)
|
||||
- Synthesizes: generalizable design patterns for safe autonomous agents; checklist format; distills incident lessons into reusable principles not in any existing page
|
||||
- **Index rebuild:** 17 missing pages added to index.md; count updated 28→43; fixed duplicate vault-filling-guide entry; all pages confirmed to exist on disk
|
||||
- Added: personal-os-state-2026-04-27, personal-os-catchup-plan-2026-04-27, user-profile, entities/library-app, comparisons/hermes-native-vs-docker, tech/hermes-eagle-mac, tech/jellyfin-transcode-rpi5, tech/vault-git-sync, concepts/agent-memory-architecture, concepts/executor-orchestrator, concepts/executor-security-incident, concepts/knowledge-lifecycle, concepts/kraken-media-stack, concepts/vault-strategy, concepts/watchlist-automation, concepts/autonomous-agent-safety, research-queue
|
||||
- **Lint:** 0 orphan pages (all pages have ≥1 inbound link from index or other pages); 0 missing frontmatter on sampled pages; tag drift noted (systemic: SCHEMA taxonomy predates wiki growth; descriptive tags in common use don't match narrow taxonomy — needs a schema update, not a per-page fix)
|
||||
- **Log.md:** Appended 2026-05-24 entry; 48 lines, far from 500 rotation limit ✅
|
||||
|
||||
## Validation fixes
|
||||
|
||||
- none (autonomous-agent-safety.md passed all checks on first write)
|
||||
|
||||
## Unresolved conflicts
|
||||
|
||||
(none)
|
||||
|
||||
## Unfinished
|
||||
|
||||
(none)
|
||||
|
||||
## Stats
|
||||
|
||||
- Conflicts resolved: 0
|
||||
- Inbox processed: 0 (empty)
|
||||
- Sessions crystallized: 0 / 0 checked (no sessions for 2026-05-24)
|
||||
- Synthesis pages created: 1 (concepts/autonomous-agent-safety)
|
||||
- Pages created: 1 (autonomous-agent-safety.md)
|
||||
- Pages updated: 3 (index.md, log.md, research-queue.md)
|
||||
- Lint issues: 1 systemic (tag drift — SCHEMA taxonomy needs expansion, no per-page fix needed)
|
||||
- Validation issues fixed: 0
|
||||
@@ -0,0 +1,113 @@
|
||||
---
|
||||
title: Autonomous Agent Safety Patterns
|
||||
created: '2026-05-24'
|
||||
updated: '2026-05-24'
|
||||
type: concept
|
||||
tags: [agent, security, architecture, executor, rules]
|
||||
sources:
|
||||
- wiki/concepts/executor-security-incident.md
|
||||
- wiki/concepts/executor-orchestrator.md
|
||||
- wiki/personal-os-agent-rules.md
|
||||
confidence: high
|
||||
related:
|
||||
- "[[concepts/executor-security-incident]]"
|
||||
- "[[concepts/executor-orchestrator]]"
|
||||
- "[[personal-os-agent-rules]]"
|
||||
---
|
||||
|
||||
# Autonomous Agent Safety Patterns
|
||||
|
||||
Design principles for autonomous LLM agents distilled from the 2026-05-11
|
||||
executor security incident. General enough to apply beyond the personal-os context.
|
||||
|
||||
## The Three Failure Modes (from incident)
|
||||
|
||||
### 1. Mandatory prompt steps that outrank modes
|
||||
|
||||
The executor wrote Asana comments during "recording-only" mode because the
|
||||
worker prompt declared comment posting a *mandatory completion action* — not
|
||||
subject to mode flags.
|
||||
|
||||
**Pattern:** Every completion action (write to external system, post comment,
|
||||
send notification) must be guarded by a mode check that the agent cannot
|
||||
override.
|
||||
|
||||
```
|
||||
IF mode == "recording-only":
|
||||
SKIP external writes
|
||||
LOG "would have posted: ..." instead
|
||||
```
|
||||
|
||||
### 2. Boundary policies that only cover exfiltration
|
||||
|
||||
The lethal-trifecta policy blocked HTTP to attacker domains after internal
|
||||
MCP access. It did NOT block writes *to* internal systems (Asana).
|
||||
|
||||
**Pattern:** Separate the threat models:
|
||||
- **Exfiltration** = data leaving to unauthorized destinations → block outbound
|
||||
- **Unauthorized writes** = data going to authorized systems without approval → require
|
||||
explicit confirmation gate per write type
|
||||
|
||||
These are different controls. A policy that only covers one leaves the other open.
|
||||
|
||||
### 3. High-level directives not propagated to sub-prompts
|
||||
|
||||
"Don't touch anything" was a session-level directive. The worker
|
||||
sub-prompt (spawned per task) didn't inherit it — it ran its own
|
||||
completion protocol.
|
||||
|
||||
**Pattern:** Mode flags must be passed explicitly to every spawned
|
||||
sub-process/sub-prompt as a first-class parameter, not assumed from
|
||||
session context.
|
||||
|
||||
## The Auto-Approve Table Pattern
|
||||
|
||||
From [[concepts/executor-orchestrator]]: instead of blanket trust or blanket
|
||||
denial, classify actions by risk tier:
|
||||
|
||||
| Risk | Action type | Default |
|
||||
|------|-------------|---------|
|
||||
| Low | git, build, test, worktree | auto-approve |
|
||||
| Medium | draft PR, push branch | auto-approve with log |
|
||||
| High | post Asana comment, merge PR | require Alex confirmation |
|
||||
| Blocked | autonomous Asana write | denied always |
|
||||
|
||||
This table lives in the orchestrator, not the worker. Workers *request*
|
||||
actions; orchestrator decides.
|
||||
|
||||
## Least-Privilege Credential Design
|
||||
|
||||
From incident: `ASANA_API_KEY` was full-account CRUD (PATs are not granular).
|
||||
One compromised agent → full Asana write access.
|
||||
|
||||
**Pattern:** Scope credentials to the minimum required operation:
|
||||
- Read-only keys for read-only agents
|
||||
- Write keys injected only at the moment of approved write
|
||||
- Never persist write credentials in always-on agent environments
|
||||
|
||||
## Audit Before Autonomous
|
||||
|
||||
The incident ran 18 PRs and 5 Asana comments before detection. Detection only
|
||||
happened because Alex checked manually.
|
||||
|
||||
**Pattern:** Autonomous runs should produce an observable audit trail that
|
||||
can be reviewed without running the agent:
|
||||
- Structured log per run (not just stdout)
|
||||
- Diff-friendly format (what was written, to where, at what time)
|
||||
- Periodic summary posted to a channel Alex monitors
|
||||
|
||||
## Summary: Checklist for New Autonomous Agents
|
||||
|
||||
- [ ] Every external write is behind a mode-guard (can "recording-only" block it?)
|
||||
- [ ] Exfiltration and unauthorized-write policies are separate controls
|
||||
- [ ] Mode flags propagate explicitly to sub-prompts
|
||||
- [ ] Auto-approve table is in the orchestrator, not the worker
|
||||
- [ ] Credentials are scoped to minimum; write keys not always-on
|
||||
- [ ] Each run produces a structured audit log
|
||||
- [ ] Audit log goes somewhere Alex sees without hunting
|
||||
|
||||
## See Also
|
||||
|
||||
- [[concepts/executor-security-incident]] — incident post-mortem with full timeline
|
||||
- [[concepts/executor-orchestrator]] — post-incident architecture (orchestrator pattern)
|
||||
- [[personal-os-agent-rules]] — Eagle's specific rules derived from these patterns
|
||||
+31
-6
@@ -1,13 +1,13 @@
|
||||
---
|
||||
title: Wiki Index
|
||||
updated: '2026-05-23'
|
||||
updated: '2026-05-24'
|
||||
---
|
||||
|
||||
# Wiki Index
|
||||
|
||||
> Content catalog. Every wiki page listed with a one-line summary.
|
||||
> Read this first to find relevant pages for any query.
|
||||
> Last updated: 2026-05-23 | Total pages: 28
|
||||
> Last updated: 2026-05-24 | Total pages: 43
|
||||
|
||||
## Personal OS — Core
|
||||
|
||||
@@ -17,6 +17,8 @@ updated: '2026-05-23'
|
||||
- [[personal-os-self-modification]] — How Eagle and Alex can safely evolve the system
|
||||
- [[personal-os-sync-pipeline]] — sync.js + generate-status.js: how Asana data flows into status.md
|
||||
- [[personal-os-schema]] — PostgreSQL schema: tasks, stories, task_edges, wiki_pages, memory_store
|
||||
- [[personal-os-state-2026-04-27]] — State snapshot post-catchup execution (Apr 2026); supersedes v3 plan docs
|
||||
- [[personal-os-catchup-plan-2026-04-27]] — Executor build-order handoff doc; companion to state snapshot
|
||||
|
||||
## Work / DDG
|
||||
|
||||
@@ -47,16 +49,39 @@ updated: '2026-05-23'
|
||||
- [[tech/htpc-kodi-layout]] — Kodi layout, WoL MAC, NFS sources
|
||||
- [[tech/reflect-skip-fuse]] — New SwiftUI View requires manual Kotlin stub in 2 places
|
||||
- [[tech/arr-stack-taiga]] — Taiga arr stack (2026-05-20), config, router.py location
|
||||
- [[tech/hermes-eagle-mac]] — Hermes on Eagle Mac M4; claude-proxy, Zulip setup, known pitfalls
|
||||
- [[tech/jellyfin-transcode-rpi5]] — Jellyfin RPi5 transcoding pitfalls; PGS/subtitle handling
|
||||
- [[tech/vault-git-sync]] — Vault git sync via Taiga bare repo; setup, pull hooks, pitfalls
|
||||
|
||||
## Personal Projects
|
||||
## Entities
|
||||
|
||||
- (none yet — Reflect app to be added)
|
||||
- [[user-profile]] — Alex's profile; roles, working style, preferences
|
||||
- [[entities/library-app]] — Personal book library web UI on TrueNAS; replacement for inpxer (May 2026)
|
||||
|
||||
## Concepts
|
||||
## Comparisons
|
||||
|
||||
- [[comparisons/hermes-native-vs-docker]] — Hermes on Eagle (native) vs Kraken (Docker); deployment trade-offs
|
||||
|
||||
## Concepts — AI & Agents
|
||||
|
||||
- [[concepts/autonomous-agent-safety]] — Design patterns for safe autonomous agents; distilled from security incident
|
||||
- [[concepts/executor-orchestrator]] — Eagle-as-orchestrator spawning Executor worker; auto-approve protocol table
|
||||
- [[concepts/executor-security-incident]] — Post-mortem: autonomous Asana boundary crossing (May 2026); root causes
|
||||
- [[concepts/agent-memory-architecture]] — LLM agent memory taxonomy (arXiv 2603.07670) applied to personal-os
|
||||
- [[concepts/knowledge-lifecycle]] — How knowledge flows from session to permanent wiki memory
|
||||
|
||||
## Concepts — Vault & Wiki
|
||||
|
||||
- [[concepts/vault-agent-integration]] — How Eagle, wiki-ingest, and obsidian-mcp work as a unified vault layer
|
||||
- [[concepts/vault-strategy]] — Three vault tasks that must not be mixed (enrichment, storage, agent-context)
|
||||
|
||||
## Concepts — Media & Home
|
||||
|
||||
- [[concepts/kraken-media-stack]] — Full Kraken media server stack; Jellyfin, Arr, Transmission overview
|
||||
- [[concepts/watchlist-automation]] — Full watchlist automation flow; Radarr/Sonarr triggers to Jellyfin
|
||||
|
||||
## Meta
|
||||
|
||||
- [[research-queue]] — Wiki gap tracker; topics to research and crystallize
|
||||
- [[SCHEMA]] — Domain rules, tag taxonomy, frontmatter conventions
|
||||
- [[vault-filling-guide]] — Listed above; also describes vault structure
|
||||
- [[log]] — Chronological action log
|
||||
|
||||
+12
-1
@@ -1,6 +1,6 @@
|
||||
---
|
||||
title: Wiki Log
|
||||
updated: '2026-05-23'
|
||||
updated: '2026-05-24'
|
||||
type: meta
|
||||
---
|
||||
|
||||
@@ -35,3 +35,14 @@ type: meta
|
||||
- Created: htpc-bazzite-proton.md (from family/projects/htpc-windows-games-fix.md)
|
||||
- Created: concepts/vault-agent-integration.md (synthesis)
|
||||
- Lint: no conflicts, no inbox items, no sessions to crystallize
|
||||
|
||||
## [2026-05-24] update | Index rebuild + synthesis page
|
||||
- Conflicts: 0 found
|
||||
- Inbox: empty
|
||||
- Sessions: none for 2026-05-24 (cron session 2026-05-23 was wiki curation itself — not crystallizable)
|
||||
- Research queue: marked executor-orchestrator and executor-security-incident as completed
|
||||
- Created: concepts/autonomous-agent-safety.md (synthesis across executor-security-incident + executor-orchestrator + personal-os-agent-rules)
|
||||
- Updated: index.md — 17 missing pages added; count 28→43; fixed duplicate vault-filling-guide entry
|
||||
- Updated: research-queue.md — 2 queue items marked completed, updated date
|
||||
- Lint: 0 orphans (all pages have ≥1 inbound link); 0 broken frontmatter; tag drift noted (systemic — SCHEMA taxonomy predates actual page growth; no action this run)
|
||||
- Validation: autonomous-agent-safety.md frontmatter valid, 3 outbound wikilinks ✅
|
||||
|
||||
@@ -1,6 +1,6 @@
|
||||
---
|
||||
title: Research Queue
|
||||
updated: '2026-05-23'
|
||||
updated: '2026-05-24'
|
||||
type: meta
|
||||
---
|
||||
|
||||
@@ -11,9 +11,10 @@ type: meta
|
||||
|
||||
## Queue
|
||||
|
||||
- [ ] Executor Architecture v2 — executor-runner.sh + executor-analyzer.sh + state machine + DB schema
|
||||
- [ ] Executor Security Incident — 2026-05-11 Asana boundary crossing, control failure, credential inventory
|
||||
(empty)
|
||||
|
||||
## Completed
|
||||
|
||||
- [x] WireGuard VPN → [[tech/wireguard-vpn]] (2026-05-23)
|
||||
- [x] Executor Architecture v2 → [[concepts/executor-orchestrator]] (2026-05-19)
|
||||
- [x] Executor Security Incident → [[concepts/executor-security-incident]] (2026-05-22)
|
||||
|
||||
Reference in New Issue
Block a user