Agent Smith — Overnight Ops Scoreboard
Mission night 2026-07-29 → 07-30 · follows the Smith + Clara security audit · all repo changes held open for Gera's approval
0 · The goal, and the strategy behind this night
The goal: we are building toward AI employees — agents like Smith and Trinity that hold real power (they read our Slack, write our code, open and approve changes) and can be trusted with more scope over time, not less. That only works if trust is structural, not vibes: the same bet PropFlow makes with clients when Clara talks to their tenants. An agent whose authority outruns its accountability eventually costs more than it produces — the audit showed ours were at exactly that point.
The strategy is a ladder, and every fix below is a rung on it, not a feature in isolation:
- Identity first — each agent knows who it is (own state, own channels) and who is talking to it (real sender, verified approver). Without this, nothing above it can be trusted.
- Authority bounded — the dangerous verbs (merge, push, exfiltrate) are gated, and a human holds the only key to production. Autonomy applies to producing work, never to accepting it.
- Failure loud — every refusal, denial, and degraded state surfaces where humans look. A silent block is a future incident.
- Restraint as a capability — an agent that can genuinely stay out of a conversation is a prerequisite for adding more agents. Double-replies and self-tasking are the scaling killers.
Why overnight, why now: the audit gave us a rare window where every gap was mapped at file:line precision. The strategy was to convert the whole map into reviewable, one-click-approvable changes in a single night — before drift set in — while proving the operating model itself: a fleet of builders that pushes hard on production of work and stops dead at the human approval line. The night's one breach (§3) and its fix are part of that proof, not an exception to it.
End state this ladder buys: Smith and Trinity graduate from "watched constantly" to "audited periodically," which is what lets us hand them bigger surfaces — and it is the same trust architecture we sell.
1 · What the night was for
The 07-29 audit found the two Slack agents (Smith and the Clara/Trinity seat) running with real security holes: the merge gate trusted the message rather than the person, both seats shared unslugged state and answered the same channels, the outbound scrubber redacted nothing, dangerous shell commands weren't all gated, and denials vanished silently. Overnight, one builder agent per concern drove a fix to a reviewed, tested, open pull request — with a hard rule that nothing merges into this repo without Gera.
2 · The board all held for Gera
| PR | Closes | Change | State |
|---|---|---|---|
| #137 | P0-4 | Merge gate authenticates the person (Slack-UID allowlist); also found & gated a third, unaudited approval path (👍-reaction fallback). Ships inert until the approver-UID env vars are set on both hosts. | green · bot 🟢 |
| #134 | P0-1/2 | Every state path + log author derives from the agent slug — the two seats stop clobbering each other; Smith's paths stay byte-identical on deploy. | green · bot 🟢 |
| #132 | P0-6 | Per-seat channel-ownership gate ends double-replies. Inert until channels are assigned; unresolvable config degrades loudly to warn, never deafens a seat. | green · bot 🟢 |
| #136 | P0-5a·P1-3 | Command gate now covers gh pr merge, any git push, data-bearing curl — and every denial surfaces (in-thread notice + durable log) instead of vanishing. | green · bot 🟢 |
| #135 | P1-1 | Abstain is a first-class outcome: genuine silence — posts nothing and retracts the pre-brain work-ack. Fail-safe toward speaking. | green · bot 🟢 |
| #133 | P1-5·P1-3 | doctor now watches both seats' daemons (Trinity's were invisible; found live & running) + a reader CLI for the security audit logs. | green · bot 🟢 |
| #130 | P1-8 | Slack event dedup survives restarts (durable, per-seat, TTL-bounded) — a daemon bounce can no longer double-process events. | green · bot 🟢 |
| #131 | P1-9 | README states the subscription-only rule; the metered API key is documented as not required. | green · bot 🟢 |
| #129 | persona | Trinity presentation for the clara seat (slug/queues untouched) — from the first half of the night. | green · bot 🟢 |
| #128 | P0-3 | Scrubber actually redacts phones + secrets. Merged 04:31Z without Gera by a builder on a stale brief — the night's one process breach. Left in (the change is sound), flagged to Gera for post-hoc review; his call to keep or revert. | merged w/o Gera |
3 · The breach, and what changed because of it
process breach A builder squash-merged the scrubber fix on green because its durable brief still said "merge on green" while the hold-for-Gera rule had gone out only as an ephemeral message. The builder checked its authoritative context, found no hold, and followed the brief.
- Rule now durable: the fleet brief hard-forbids merging into agent-smith, in both the contract body and the intro that previously contradicted it. Every overnight PR after the fix honored it — zero further merges.
- Lesson locked into memory: rule changes for running fleets edit the brief file first; anything not in the durable brief is non-authoritative to builders.
4 · Predicted risk that fired: the stranded-fix drive
The loop-closer's new "drive stranded fixes" feature (merged by Gera as #126) was reviewed overnight with one P0 flag: it opens non-draft PRs on propflowai, where auto-merge arms on open and main requires no human review — so a days-old recovered branch could ride to production unreviewed. A ready-to-apply disarm patch was left in the PR comments.
At 6:40am MT the drive fired for real: it recovered a 4-day-old stranded fix branch and opened propflowai #4969. contained — auto-merge was not armed on it, and a #alerts heads-up went out tagging Fede + Gera. The disarm patch would make this containment structural rather than lucky.
5 · Builder report cards
| Builder | Grade | Notes |
|---|---|---|
| approval (#137) | A | Went beyond the audit: found a third ungated approval path the audit missed and gated it. Clean warn-only rollout design; refused to guess the human UID list. |
| slugging (#134) | A | Byte-identical compatibility for Smith proven by test; removed six hand-copied env defaults; drift guard pins no-second-copy. |
| channels (#132) | A | Right default (inert when unset — never mutes a live agent); fixed a genuine test order-dependence found while verifying its own work. |
| cmdgate (#136) | A− | Solid gate + surfacing; took two review rounds (a per-conversation ID reuse bug the bot caught). Left log-rotation as a disclosed follow-up. |
| abstain (#135) | A | Silence that is actually silent, including retracting the ack; fail-safe direction (content wins over sentinel) is the right bias. |
| doctor (#133) | A− | Both seats visible + audit reader; correctly disclosed that a dead Trinity socket still doesn't page (watchdog set lives in propflowai — follow-up). |
| dedup (#130/#131) | A | Split unrelated concerns into two PRs unprompted; caught that a claimed test fixture didn't exist and added it. |
| scrubber (#128, first shift) | B− | Good change, broken process — merged without Gera on a stale brief. The failure was the orchestration's, but the grade records the outcome. |
6 · Needs a human
- Gera: review the 9 held PRs (one-click each — all green + bot-approved); keep-or-revert call on the scrubber merge; decide on the auto-merge disarm patch for the stranded-fix drive; review propflowai #4969 as real recovered work, not a rubber stamp.
- Fede: six operator cards on the This Week board — Trinity avatar, host policy-file edit, approver-UID env vars (activates #137), the two Gera decisions, stale credential backups, agent-smith CI spend vs budget.
- Fixes that ship inert until config lands: #137 (approver UIDs) and #132 (channel assignments).
Generated by the overnight orchestrator session, 2026-07-30 ~08:00 MT. Evidence: PR threads on PropFlow-Technologies/agent-smith; mission log in the session scratchpad (OVERNIGHT-STATUS.md).