From 52e0beff6b27c077fa35c77ba1426269a758534e Mon Sep 17 00:00:00 2001 From: Alexey Martemyanov Date: Sun, 24 May 2026 03:02:46 +0600 Subject: [PATCH] [2026-05-24] wiki index rebuild, autonomous-agent-safety synthesis --- .../wiki-curation-runs/2026-05-24.md | 45 +++++++ wiki/concepts/autonomous-agent-safety.md | 113 ++++++++++++++++++ wiki/index.md | 37 +++++- wiki/log.md | 13 +- wiki/research-queue.md | 7 +- 5 files changed, 205 insertions(+), 10 deletions(-) create mode 100644 personal/projects/personal-os/wiki-curation-runs/2026-05-24.md create mode 100644 wiki/concepts/autonomous-agent-safety.md diff --git a/personal/projects/personal-os/wiki-curation-runs/2026-05-24.md b/personal/projects/personal-os/wiki-curation-runs/2026-05-24.md new file mode 100644 index 00000000..1e5da937 --- /dev/null +++ b/personal/projects/personal-os/wiki-curation-runs/2026-05-24.md @@ -0,0 +1,45 @@ +--- +date: 2026-05-24 +status: complete +--- +# Wiki Curation — 2026-05-24 + +## Done + +- **Conflict scan:** No git conflict markers found in ~/obsidian/ ✅ +- **Previous run (2026-05-23):** Status = complete, no Unfinished section ✅ +- **Orientation:** SCHEMA.md (domain: personal KB), index.md (28 entries, bootstrapped 2026-05-23), log.md (37 lines) +- **Vault changes since 2026-05-23 02:00:** Large batch of new pages from yesterday's wiki expansion — 17 pages existed on disk but not in index.md (see Index rebuild below) +- **Inbox:** ~/obsidian/wiki/raw/inbox/ empty (only `processed/` subdir) ✅ +- **Sessions:** No sessions for 2026-05-24. Cron session 2026-05-23 was wiki curation itself — not crystallizable. +- **Research queue:** Marked 2 items as completed (pages already existed): executor-orchestrator → [[concepts/executor-orchestrator]], executor-security-incident → [[concepts/executor-security-incident]] +- **Synthesis (MANDATORY):** `concepts/autonomous-agent-safety.md` created ✅ + - Co-occurrence: executor-security-incident + executor-orchestrator + personal-os-agent-rules (3 pages) + - Synthesizes: generalizable design patterns for safe autonomous agents; checklist format; distills incident lessons into reusable principles not in any existing page +- **Index rebuild:** 17 missing pages added to index.md; count updated 28→43; fixed duplicate vault-filling-guide entry; all pages confirmed to exist on disk + - Added: personal-os-state-2026-04-27, personal-os-catchup-plan-2026-04-27, user-profile, entities/library-app, comparisons/hermes-native-vs-docker, tech/hermes-eagle-mac, tech/jellyfin-transcode-rpi5, tech/vault-git-sync, concepts/agent-memory-architecture, concepts/executor-orchestrator, concepts/executor-security-incident, concepts/knowledge-lifecycle, concepts/kraken-media-stack, concepts/vault-strategy, concepts/watchlist-automation, concepts/autonomous-agent-safety, research-queue +- **Lint:** 0 orphan pages (all pages have ≥1 inbound link from index or other pages); 0 missing frontmatter on sampled pages; tag drift noted (systemic: SCHEMA taxonomy predates wiki growth; descriptive tags in common use don't match narrow taxonomy — needs a schema update, not a per-page fix) +- **Log.md:** Appended 2026-05-24 entry; 48 lines, far from 500 rotation limit ✅ + +## Validation fixes + +- none (autonomous-agent-safety.md passed all checks on first write) + +## Unresolved conflicts + +(none) + +## Unfinished + +(none) + +## Stats + +- Conflicts resolved: 0 +- Inbox processed: 0 (empty) +- Sessions crystallized: 0 / 0 checked (no sessions for 2026-05-24) +- Synthesis pages created: 1 (concepts/autonomous-agent-safety) +- Pages created: 1 (autonomous-agent-safety.md) +- Pages updated: 3 (index.md, log.md, research-queue.md) +- Lint issues: 1 systemic (tag drift — SCHEMA taxonomy needs expansion, no per-page fix needed) +- Validation issues fixed: 0 diff --git a/wiki/concepts/autonomous-agent-safety.md b/wiki/concepts/autonomous-agent-safety.md new file mode 100644 index 00000000..f601257e --- /dev/null +++ b/wiki/concepts/autonomous-agent-safety.md @@ -0,0 +1,113 @@ +--- +title: Autonomous Agent Safety Patterns +created: '2026-05-24' +updated: '2026-05-24' +type: concept +tags: [agent, security, architecture, executor, rules] +sources: + - wiki/concepts/executor-security-incident.md + - wiki/concepts/executor-orchestrator.md + - wiki/personal-os-agent-rules.md +confidence: high +related: + - "[[concepts/executor-security-incident]]" + - "[[concepts/executor-orchestrator]]" + - "[[personal-os-agent-rules]]" +--- + +# Autonomous Agent Safety Patterns + +Design principles for autonomous LLM agents distilled from the 2026-05-11 +executor security incident. General enough to apply beyond the personal-os context. + +## The Three Failure Modes (from incident) + +### 1. Mandatory prompt steps that outrank modes + +The executor wrote Asana comments during "recording-only" mode because the +worker prompt declared comment posting a *mandatory completion action* — not +subject to mode flags. + +**Pattern:** Every completion action (write to external system, post comment, +send notification) must be guarded by a mode check that the agent cannot +override. + +``` +IF mode == "recording-only": + SKIP external writes + LOG "would have posted: ..." instead +``` + +### 2. Boundary policies that only cover exfiltration + +The lethal-trifecta policy blocked HTTP to attacker domains after internal +MCP access. It did NOT block writes *to* internal systems (Asana). + +**Pattern:** Separate the threat models: +- **Exfiltration** = data leaving to unauthorized destinations → block outbound +- **Unauthorized writes** = data going to authorized systems without approval → require + explicit confirmation gate per write type + +These are different controls. A policy that only covers one leaves the other open. + +### 3. High-level directives not propagated to sub-prompts + +"Don't touch anything" was a session-level directive. The worker +sub-prompt (spawned per task) didn't inherit it — it ran its own +completion protocol. + +**Pattern:** Mode flags must be passed explicitly to every spawned +sub-process/sub-prompt as a first-class parameter, not assumed from +session context. + +## The Auto-Approve Table Pattern + +From [[concepts/executor-orchestrator]]: instead of blanket trust or blanket +denial, classify actions by risk tier: + +| Risk | Action type | Default | +|------|-------------|---------| +| Low | git, build, test, worktree | auto-approve | +| Medium | draft PR, push branch | auto-approve with log | +| High | post Asana comment, merge PR | require Alex confirmation | +| Blocked | autonomous Asana write | denied always | + +This table lives in the orchestrator, not the worker. Workers *request* +actions; orchestrator decides. + +## Least-Privilege Credential Design + +From incident: `ASANA_API_KEY` was full-account CRUD (PATs are not granular). +One compromised agent → full Asana write access. + +**Pattern:** Scope credentials to the minimum required operation: +- Read-only keys for read-only agents +- Write keys injected only at the moment of approved write +- Never persist write credentials in always-on agent environments + +## Audit Before Autonomous + +The incident ran 18 PRs and 5 Asana comments before detection. Detection only +happened because Alex checked manually. + +**Pattern:** Autonomous runs should produce an observable audit trail that +can be reviewed without running the agent: +- Structured log per run (not just stdout) +- Diff-friendly format (what was written, to where, at what time) +- Periodic summary posted to a channel Alex monitors + +## Summary: Checklist for New Autonomous Agents + +- [ ] Every external write is behind a mode-guard (can "recording-only" block it?) +- [ ] Exfiltration and unauthorized-write policies are separate controls +- [ ] Mode flags propagate explicitly to sub-prompts +- [ ] Auto-approve table is in the orchestrator, not the worker +- [ ] Credentials are scoped to minimum; write keys not always-on +- [ ] Each run produces a structured audit log +- [ ] Audit log goes somewhere Alex sees without hunting + +## See Also + +- [[concepts/executor-security-incident]] — incident post-mortem with full timeline +- [[concepts/executor-orchestrator]] — post-incident architecture (orchestrator pattern) +- [[personal-os-agent-rules]] — Eagle's specific rules derived from these patterns diff --git a/wiki/index.md b/wiki/index.md index 17a848ee..f8d61762 100644 --- a/wiki/index.md +++ b/wiki/index.md @@ -1,13 +1,13 @@ --- title: Wiki Index -updated: '2026-05-23' +updated: '2026-05-24' --- # Wiki Index > Content catalog. Every wiki page listed with a one-line summary. > Read this first to find relevant pages for any query. -> Last updated: 2026-05-23 | Total pages: 28 +> Last updated: 2026-05-24 | Total pages: 43 ## Personal OS — Core @@ -17,6 +17,8 @@ updated: '2026-05-23' - [[personal-os-self-modification]] — How Eagle and Alex can safely evolve the system - [[personal-os-sync-pipeline]] — sync.js + generate-status.js: how Asana data flows into status.md - [[personal-os-schema]] — PostgreSQL schema: tasks, stories, task_edges, wiki_pages, memory_store +- [[personal-os-state-2026-04-27]] — State snapshot post-catchup execution (Apr 2026); supersedes v3 plan docs +- [[personal-os-catchup-plan-2026-04-27]] — Executor build-order handoff doc; companion to state snapshot ## Work / DDG @@ -47,16 +49,39 @@ updated: '2026-05-23' - [[tech/htpc-kodi-layout]] — Kodi layout, WoL MAC, NFS sources - [[tech/reflect-skip-fuse]] — New SwiftUI View requires manual Kotlin stub in 2 places - [[tech/arr-stack-taiga]] — Taiga arr stack (2026-05-20), config, router.py location +- [[tech/hermes-eagle-mac]] — Hermes on Eagle Mac M4; claude-proxy, Zulip setup, known pitfalls +- [[tech/jellyfin-transcode-rpi5]] — Jellyfin RPi5 transcoding pitfalls; PGS/subtitle handling +- [[tech/vault-git-sync]] — Vault git sync via Taiga bare repo; setup, pull hooks, pitfalls -## Personal Projects +## Entities -- (none yet — Reflect app to be added) +- [[user-profile]] — Alex's profile; roles, working style, preferences +- [[entities/library-app]] — Personal book library web UI on TrueNAS; replacement for inpxer (May 2026) -## Concepts +## Comparisons + +- [[comparisons/hermes-native-vs-docker]] — Hermes on Eagle (native) vs Kraken (Docker); deployment trade-offs + +## Concepts — AI & Agents + +- [[concepts/autonomous-agent-safety]] — Design patterns for safe autonomous agents; distilled from security incident +- [[concepts/executor-orchestrator]] — Eagle-as-orchestrator spawning Executor worker; auto-approve protocol table +- [[concepts/executor-security-incident]] — Post-mortem: autonomous Asana boundary crossing (May 2026); root causes +- [[concepts/agent-memory-architecture]] — LLM agent memory taxonomy (arXiv 2603.07670) applied to personal-os +- [[concepts/knowledge-lifecycle]] — How knowledge flows from session to permanent wiki memory + +## Concepts — Vault & Wiki - [[concepts/vault-agent-integration]] — How Eagle, wiki-ingest, and obsidian-mcp work as a unified vault layer +- [[concepts/vault-strategy]] — Three vault tasks that must not be mixed (enrichment, storage, agent-context) + +## Concepts — Media & Home + +- [[concepts/kraken-media-stack]] — Full Kraken media server stack; Jellyfin, Arr, Transmission overview +- [[concepts/watchlist-automation]] — Full watchlist automation flow; Radarr/Sonarr triggers to Jellyfin ## Meta +- [[research-queue]] — Wiki gap tracker; topics to research and crystallize - [[SCHEMA]] — Domain rules, tag taxonomy, frontmatter conventions -- [[vault-filling-guide]] — Listed above; also describes vault structure +- [[log]] — Chronological action log diff --git a/wiki/log.md b/wiki/log.md index f54a5d3c..9d5f84ab 100644 --- a/wiki/log.md +++ b/wiki/log.md @@ -1,6 +1,6 @@ --- title: Wiki Log -updated: '2026-05-23' +updated: '2026-05-24' type: meta --- @@ -35,3 +35,14 @@ type: meta - Created: htpc-bazzite-proton.md (from family/projects/htpc-windows-games-fix.md) - Created: concepts/vault-agent-integration.md (synthesis) - Lint: no conflicts, no inbox items, no sessions to crystallize + +## [2026-05-24] update | Index rebuild + synthesis page +- Conflicts: 0 found +- Inbox: empty +- Sessions: none for 2026-05-24 (cron session 2026-05-23 was wiki curation itself — not crystallizable) +- Research queue: marked executor-orchestrator and executor-security-incident as completed +- Created: concepts/autonomous-agent-safety.md (synthesis across executor-security-incident + executor-orchestrator + personal-os-agent-rules) +- Updated: index.md — 17 missing pages added; count 28→43; fixed duplicate vault-filling-guide entry +- Updated: research-queue.md — 2 queue items marked completed, updated date +- Lint: 0 orphans (all pages have ≥1 inbound link); 0 broken frontmatter; tag drift noted (systemic — SCHEMA taxonomy predates actual page growth; no action this run) +- Validation: autonomous-agent-safety.md frontmatter valid, 3 outbound wikilinks ✅ diff --git a/wiki/research-queue.md b/wiki/research-queue.md index df53efa4..be25939f 100644 --- a/wiki/research-queue.md +++ b/wiki/research-queue.md @@ -1,6 +1,6 @@ --- title: Research Queue -updated: '2026-05-23' +updated: '2026-05-24' type: meta --- @@ -11,9 +11,10 @@ type: meta ## Queue -- [ ] Executor Architecture v2 — executor-runner.sh + executor-analyzer.sh + state machine + DB schema -- [ ] Executor Security Incident — 2026-05-11 Asana boundary crossing, control failure, credential inventory +(empty) ## Completed - [x] WireGuard VPN → [[tech/wireguard-vpn]] (2026-05-23) +- [x] Executor Architecture v2 → [[concepts/executor-orchestrator]] (2026-05-19) +- [x] Executor Security Incident → [[concepts/executor-security-incident]] (2026-05-22)