[2026-05-24] wiki index rebuild, autonomous-agent-safety synthesis

personal/projects/personal-os/wiki-curation-runs/2026-05-24.md

@@ -0,0 +1,45 @@
+---
+date: 2026-05-24
+status: complete
+---
+# Wiki Curation — 2026-05-24
+
+## Done
+
+- **Conflict scan:** No git conflict markers found in ~/obsidian/ ✅
+- **Previous run (2026-05-23):** Status = complete, no Unfinished section ✅
+- **Orientation:** SCHEMA.md (domain: personal KB), index.md (28 entries, bootstrapped 2026-05-23), log.md (37 lines)
+- **Vault changes since 2026-05-23 02:00:** Large batch of new pages from yesterday's wiki expansion — 17 pages existed on disk but not in index.md (see Index rebuild below)
+- **Inbox:** ~/obsidian/wiki/raw/inbox/ empty (only `processed/` subdir) ✅
+- **Sessions:** No sessions for 2026-05-24. Cron session 2026-05-23 was wiki curation itself — not crystallizable.
+- **Research queue:** Marked 2 items as completed (pages already existed): executor-orchestrator → [[concepts/executor-orchestrator]], executor-security-incident → [[concepts/executor-security-incident]]
+- **Synthesis (MANDATORY):** `concepts/autonomous-agent-safety.md` created ✅
+  - Co-occurrence: executor-security-incident + executor-orchestrator + personal-os-agent-rules (3 pages)
+  - Synthesizes: generalizable design patterns for safe autonomous agents; checklist format; distills incident lessons into reusable principles not in any existing page
+- **Index rebuild:** 17 missing pages added to index.md; count updated 28→43; fixed duplicate vault-filling-guide entry; all pages confirmed to exist on disk
+  - Added: personal-os-state-2026-04-27, personal-os-catchup-plan-2026-04-27, user-profile, entities/library-app, comparisons/hermes-native-vs-docker, tech/hermes-eagle-mac, tech/jellyfin-transcode-rpi5, tech/vault-git-sync, concepts/agent-memory-architecture, concepts/executor-orchestrator, concepts/executor-security-incident, concepts/knowledge-lifecycle, concepts/kraken-media-stack, concepts/vault-strategy, concepts/watchlist-automation, concepts/autonomous-agent-safety, research-queue
+- **Lint:** 0 orphan pages (all pages have ≥1 inbound link from index or other pages); 0 missing frontmatter on sampled pages; tag drift noted (systemic: SCHEMA taxonomy predates wiki growth; descriptive tags in common use don't match narrow taxonomy — needs a schema update, not a per-page fix)
+- **Log.md:** Appended 2026-05-24 entry; 48 lines, far from 500 rotation limit ✅
+
+## Validation fixes
+
+- none (autonomous-agent-safety.md passed all checks on first write)
+
+## Unresolved conflicts
+
+(none)
+
+## Unfinished
+
+(none)
+
+## Stats
+
+- Conflicts resolved: 0
+- Inbox processed: 0 (empty)
+- Sessions crystallized: 0 / 0 checked (no sessions for 2026-05-24)
+- Synthesis pages created: 1 (concepts/autonomous-agent-safety)
+- Pages created: 1 (autonomous-agent-safety.md)
+- Pages updated: 3 (index.md, log.md, research-queue.md)
+- Lint issues: 1 systemic (tag drift — SCHEMA taxonomy needs expansion, no per-page fix needed)
+- Validation issues fixed: 0

wiki/concepts/autonomous-agent-safety.md

@@ -0,0 +1,113 @@
+---
+title: Autonomous Agent Safety Patterns
+created: '2026-05-24'
+updated: '2026-05-24'
+type: concept
+tags: [agent, security, architecture, executor, rules]
+sources:
+  - wiki/concepts/executor-security-incident.md
+  - wiki/concepts/executor-orchestrator.md
+  - wiki/personal-os-agent-rules.md
+confidence: high
+related:
+  - "[[concepts/executor-security-incident]]"
+  - "[[concepts/executor-orchestrator]]"
+  - "[[personal-os-agent-rules]]"
+---
+
+# Autonomous Agent Safety Patterns
+
+Design principles for autonomous LLM agents distilled from the 2026-05-11
+executor security incident. General enough to apply beyond the personal-os context.
+
+## The Three Failure Modes (from incident)
+
+### 1. Mandatory prompt steps that outrank modes
+
+The executor wrote Asana comments during "recording-only" mode because the
+worker prompt declared comment posting a *mandatory completion action* — not
+subject to mode flags.
+
+**Pattern:** Every completion action (write to external system, post comment,
+send notification) must be guarded by a mode check that the agent cannot
+override.
+
+```
+IF mode == "recording-only":
+    SKIP external writes
+    LOG "would have posted: ..." instead
+```
+
+### 2. Boundary policies that only cover exfiltration
+
+The lethal-trifecta policy blocked HTTP to attacker domains after internal
+MCP access. It did NOT block writes *to* internal systems (Asana).
+
+**Pattern:** Separate the threat models:
+- **Exfiltration** = data leaving to unauthorized destinations → block outbound
+- **Unauthorized writes** = data going to authorized systems without approval → require
+  explicit confirmation gate per write type
+
+These are different controls. A policy that only covers one leaves the other open.
+
+### 3. High-level directives not propagated to sub-prompts
+
+"Don't touch anything" was a session-level directive. The worker
+sub-prompt (spawned per task) didn't inherit it — it ran its own
+completion protocol.
+
+**Pattern:** Mode flags must be passed explicitly to every spawned
+sub-process/sub-prompt as a first-class parameter, not assumed from
+session context.
+
+## The Auto-Approve Table Pattern
+
+From [[concepts/executor-orchestrator]]: instead of blanket trust or blanket
+denial, classify actions by risk tier:
+
+| Risk | Action type | Default |
+|------|-------------|---------|
+| Low | git, build, test, worktree | auto-approve |
+| Medium | draft PR, push branch | auto-approve with log |
+| High | post Asana comment, merge PR | require Alex confirmation |
+| Blocked | autonomous Asana write | denied always |
+
+This table lives in the orchestrator, not the worker. Workers *request*
+actions; orchestrator decides.
+
+## Least-Privilege Credential Design
+
+From incident: `ASANA_API_KEY` was full-account CRUD (PATs are not granular).
+One compromised agent → full Asana write access.
+
+**Pattern:** Scope credentials to the minimum required operation:
+- Read-only keys for read-only agents
+- Write keys injected only at the moment of approved write
+- Never persist write credentials in always-on agent environments
+
+## Audit Before Autonomous
+
+The incident ran 18 PRs and 5 Asana comments before detection. Detection only
+happened because Alex checked manually.
+
+**Pattern:** Autonomous runs should produce an observable audit trail that
+can be reviewed without running the agent:
+- Structured log per run (not just stdout)
+- Diff-friendly format (what was written, to where, at what time)
+- Periodic summary posted to a channel Alex monitors
+
+## Summary: Checklist for New Autonomous Agents
+
+- [ ] Every external write is behind a mode-guard (can "recording-only" block it?)
+- [ ] Exfiltration and unauthorized-write policies are separate controls
+- [ ] Mode flags propagate explicitly to sub-prompts
+- [ ] Auto-approve table is in the orchestrator, not the worker
+- [ ] Credentials are scoped to minimum; write keys not always-on
+- [ ] Each run produces a structured audit log
+- [ ] Audit log goes somewhere Alex sees without hunting
+
+## See Also
+
+- [[concepts/executor-security-incident]] — incident post-mortem with full timeline
+- [[concepts/executor-orchestrator]] — post-incident architecture (orchestrator pattern)
+- [[personal-os-agent-rules]] — Eagle's specific rules derived from these patterns

wiki/index.md

@@ -1,13 +1,13 @@
 ---
 title: Wiki Index
-updated: '2026-05-23'
+updated: '2026-05-24'
 ---
 
 # Wiki Index
 
 > Content catalog. Every wiki page listed with a one-line summary.
 > Read this first to find relevant pages for any query.
-> Last updated: 2026-05-23 | Total pages: 28
+> Last updated: 2026-05-24 | Total pages: 43
 
 ## Personal OS — Core
 
@@ -17,6 +17,8 @@ updated: '2026-05-23'
 - [[personal-os-self-modification]] — How Eagle and Alex can safely evolve the system
 - [[personal-os-sync-pipeline]] — sync.js + generate-status.js: how Asana data flows into status.md
 - [[personal-os-schema]] — PostgreSQL schema: tasks, stories, task_edges, wiki_pages, memory_store
+- [[personal-os-state-2026-04-27]] — State snapshot post-catchup execution (Apr 2026); supersedes v3 plan docs
+- [[personal-os-catchup-plan-2026-04-27]] — Executor build-order handoff doc; companion to state snapshot
 
 ## Work / DDG
 
@@ -47,16 +49,39 @@ updated: '2026-05-23'
 - [[tech/htpc-kodi-layout]] — Kodi layout, WoL MAC, NFS sources
 - [[tech/reflect-skip-fuse]] — New SwiftUI View requires manual Kotlin stub in 2 places
 - [[tech/arr-stack-taiga]] — Taiga arr stack (2026-05-20), config, router.py location
+- [[tech/hermes-eagle-mac]] — Hermes on Eagle Mac M4; claude-proxy, Zulip setup, known pitfalls
+- [[tech/jellyfin-transcode-rpi5]] — Jellyfin RPi5 transcoding pitfalls; PGS/subtitle handling
+- [[tech/vault-git-sync]] — Vault git sync via Taiga bare repo; setup, pull hooks, pitfalls
 
-## Personal Projects
+## Entities
 
-- (none yet — Reflect app to be added)
+- [[user-profile]] — Alex's profile; roles, working style, preferences
+- [[entities/library-app]] — Personal book library web UI on TrueNAS; replacement for inpxer (May 2026)
 
-## Concepts
+## Comparisons
+
+- [[comparisons/hermes-native-vs-docker]] — Hermes on Eagle (native) vs Kraken (Docker); deployment trade-offs
+
+## Concepts — AI & Agents
+
+- [[concepts/autonomous-agent-safety]] — Design patterns for safe autonomous agents; distilled from security incident
+- [[concepts/executor-orchestrator]] — Eagle-as-orchestrator spawning Executor worker; auto-approve protocol table
+- [[concepts/executor-security-incident]] — Post-mortem: autonomous Asana boundary crossing (May 2026); root causes
+- [[concepts/agent-memory-architecture]] — LLM agent memory taxonomy (arXiv 2603.07670) applied to personal-os
+- [[concepts/knowledge-lifecycle]] — How knowledge flows from session to permanent wiki memory
+
+## Concepts — Vault & Wiki
 
 - [[concepts/vault-agent-integration]] — How Eagle, wiki-ingest, and obsidian-mcp work as a unified vault layer
+- [[concepts/vault-strategy]] — Three vault tasks that must not be mixed (enrichment, storage, agent-context)
+
+## Concepts — Media & Home
+
+- [[concepts/kraken-media-stack]] — Full Kraken media server stack; Jellyfin, Arr, Transmission overview
+- [[concepts/watchlist-automation]] — Full watchlist automation flow; Radarr/Sonarr triggers to Jellyfin
 
 ## Meta
 
+- [[research-queue]] — Wiki gap tracker; topics to research and crystallize
 - [[SCHEMA]] — Domain rules, tag taxonomy, frontmatter conventions
-- [[vault-filling-guide]] — Listed above; also describes vault structure
+- [[log]] — Chronological action log

wiki/log.md

@@ -1,6 +1,6 @@
 ---
 title: Wiki Log
-updated: '2026-05-23'
+updated: '2026-05-24'
 type: meta
 ---
 
@@ -35,3 +35,14 @@ type: meta
 - Created: htpc-bazzite-proton.md (from family/projects/htpc-windows-games-fix.md)
 - Created: concepts/vault-agent-integration.md (synthesis)
 - Lint: no conflicts, no inbox items, no sessions to crystallize
+
+## [2026-05-24] update | Index rebuild + synthesis page
+- Conflicts: 0 found
+- Inbox: empty
+- Sessions: none for 2026-05-24 (cron session 2026-05-23 was wiki curation itself — not crystallizable)
+- Research queue: marked executor-orchestrator and executor-security-incident as completed
+- Created: concepts/autonomous-agent-safety.md (synthesis across executor-security-incident + executor-orchestrator + personal-os-agent-rules)
+- Updated: index.md — 17 missing pages added; count 28→43; fixed duplicate vault-filling-guide entry
+- Updated: research-queue.md — 2 queue items marked completed, updated date
+- Lint: 0 orphans (all pages have ≥1 inbound link); 0 broken frontmatter; tag drift noted (systemic — SCHEMA taxonomy predates actual page growth; no action this run)
+- Validation: autonomous-agent-safety.md frontmatter valid, 3 outbound wikilinks ✅

wiki/research-queue.md

@@ -1,6 +1,6 @@
 ---
 title: Research Queue
-updated: '2026-05-23'
+updated: '2026-05-24'
 type: meta
 ---
 
@@ -11,9 +11,10 @@ type: meta
 
 ## Queue
 
-- [ ] Executor Architecture v2 — executor-runner.sh + executor-analyzer.sh + state machine + DB schema
+(empty)
-- [ ] Executor Security Incident — 2026-05-11 Asana boundary crossing, control failure, credential inventory
 
 ## Completed
 
 - [x] WireGuard VPN → [[tech/wireguard-vpn]] (2026-05-23)
+- [x] Executor Architecture v2 → [[concepts/executor-orchestrator]] (2026-05-19)
+- [x] Executor Security Incident → [[concepts/executor-security-incident]] (2026-05-22)