You built this system over months on instinct, and most of the instincts were right. This is the map of what stands, what was found leaking today, the six checkpoints that close the gaps, and an honest statement of how robust the result is — and isn't.
Five load-bearing decisions were correct and stay untouched:
Secret values never enter agent context. Keychain delivery at launch, vault-guard blocking reads in-session, OpenBao as the source of record.
Every agent writes GitHub as its own pantheon-*-app[bot]. The operator's identity never authors agent work.
One queryable place answers "what is open, who owns it" — the precondition for everything below.
Containment that blocked 0 of 4 real incidents while taxing every session was negative security. Dropping it was systems engineering — done empirically.
Four concrete leaks, all found and evidenced in one session — which is itself the finding: nothing was watching.
| Finding | Evidence | Class |
|---|---|---|
| Vault server two security releases behind | n5 bao 2.5.3; 2.5.4 + 2.5.5 are CVE releases, unnoticed since 17 Jun | SECURITY |
| Alerts terminate in human inboxes | GitGuardian incident "Ignored ×6" — no route into agent sessions | SECURITY |
| A daemon was un-fixing committed work | Argus auto-injected a stale dead-path block into fleet CLAUDE.md every 6h, silently reverting the consolidation standard | INTEGRITY |
| Gates misfire and tax every session | 5 false blocks in one session; one gate bug made a required marker unrecordable for weeks | EFFICIENCY |
Pattern behind all four: detection, routing, and verification were built as habits, not as loops. A habit skips a day. A loop doesn't.
In focus order. Each closes a named gap and carries its own proof-of-done — no checkpoint is "done" by assertion, only by its verification firing.
Argus injection retired (PR #155), dependency-drift probe P31 built and live-verified, local CLI updates applied, poisoned files restored, gate recorder fixed.
GitGuardian webhook → signature-verified n8n flow → deduped, false-positives dropped → board issue labeled for Hephaistos + Slack ping. Alerts become work items agents see at session start — never again an "Ignored ×6".
n5 OpenBao 2.5.3 → 2.5.5 with release-notes review during (2.5.4 removes legacy lease endpoints — scripts using them must be checked), KV smoke read after.
sys/health reports 2.5.5 unsealed; P31 critical flag clears on next Argus run.Every morning in Slack: releases behind (security-critical called out), open secret incidents, daemon health. Your standing question — "are we drifting behind?" — answered daily, automatically, from sources that already exist (Argus P31, GG API, proteus daemon table).
Finish AGENTS.md consolidation fleet-wide, then slim the ~20 always-loaded global rules. Every session currently pays thousands of tokens of directive weight before the first word of work. This is the single largest recurring efficiency gain available.
Any harness (Claude Code, Codex, Gemini, Pi) runs a constellation with the same env vars, credentials, system files, and — the gating leg — the same guards. Hard rule encoded in the epic: no non-Claude harness gets a pane with live credentials until a vault-guard-equivalent exists for it.
n5 redundancy addressed, daemon fleet consolidated (42 jobs → curated, 11 failures triaged), and a restore drill — a backup nobody has restored from is a hope, not a backup.
One loop, running continuously, with the operator reading a digest instead of email warnings:
| Layer | Mechanism | Contains |
|---|---|---|
| Identity | Per-agent GitHub App tokens, PAT forbidden for agent writes | Who can author what |
| Credentials | Keychain injection per least-priv profile + vault-guard read blocking | What secrets a session can touch or see |
| Session gates | Moirai markers (orient before write), hook guards — with false-positive telemetry so gates stay honest | Order of operations: read SSOT before mutating it |
| Review | Risk-classed PR routing; critical paths never direct-to-main; Hephaistos merge gate | What reaches main |
| Observation | Argus probes (drift, deps, state), Cerberus, GG — all landing on boards | What silently rots |
| Recovery | Backups + rehearsed restore, daemon health dashboard | Blast radius when something still breaks |
After all six checkpoints: robust where it matters for this system's real threat model. Secrets can't ride into context or repos unnoticed (three layers + routed alerts). A security release can't sit unapplied for weeks (daily detection + same-day-update rule). A daemon can't silently corrupt directive files (auto-remediation of semantic files is now banned by design). Drift — of versions, checkouts, docs — gets found by probes within hours, not by accident within months. Any single agent's mistake passes through review gates before it reaches main.
What it still is not — by choice, and you should know it: enforcement is behavioral, not OS-level. Agents share one user account on one machine; the hooks and gates that contain them are convention an aligned agent obeys, not walls a malicious one couldn't cross. That is an acceptable, deliberate trade for a solo-operator fleet — the 2026-04 sandbox experiment proved hard containment cost more than it protected. The honest names for the end state: defense-in-depth against accidents and drift, verified continuously — not a zero-trust datacenter. The remaining single points of failure are you and the hardware; CP6 shrinks the hardware one, and the digest shrinks the you-as-bottleneck one.
| Threat | Today | After CP1–CP6 |
|---|---|---|
| Secret committed to a repo | Email warning, ignorable | Signed webhook → board issue → Hephaistos queue, same day STRONG |
| Known CVE in core service | Found by luck (today: 25 days late) | Critical flag within 6h, digest next morning STRONG |
| Silent config/doc drift | Found when it breaks something | Probe-detected, board-routed STRONG |
| Agent error reaching main | Review gates (already good) | Same + gate FP telemetry keeps them trusted STRONG |
| Compromised/malicious agent process | Behavioral guards only | Unchanged — accepted risk, documented ACCEPTED |
| Machine loss | Backups exist, restore untested | Rehearsed restore + n5 redundancy GOOD |
| Operator unavailable | Fleet idles safely | Same — by design ACCEPTED |
The point of all of it: product work — Viska, clients, trading, the CRM — builds on a floor that maintains itself. Sessions start lean (CP4), any harness (CP5), with guards on (CP0/5), on patched infrastructure (CP2/3), where anything that goes wrong becomes a routed, owned, verified work item (CP1) on a foundation you could restore tomorrow (CP6). The fleet stops spending its sessions discovering its own decay — and spends them building.
atlas · wr-pantheon · 2026-07-12 · sources: live session evidence (P31 smoke, n5 sys/health, GG incident 34755295, remediation-log), board epics atlas#136/#137–141, PR infra-pantheon#155, handoffs to hades/pantheon-ops · tier: verified findings live, projections labeled as such