All topics · 22 posts
Incidents, recovery, authorization boundaries, supply-chain risk, and fail-closed engineering.
A deferred-effects manifest can preserve proposed intent, suspend dependency-bound work, and compile a review bundle while native action approval remains the only approval authority for the external effect.
A prepared agent workflow can be useful and still not be authorized. The safe pattern is to turn readiness into an activation packet: scope, evidence, boundary state, rollback limits, specific activation verb, and explicit authority.
Do not hand setup credentials to runtime route code just because the next integration step looks obvious. Treat the credential boundary itself as a production feature: narrow identity, bounded token minting, negative proofs, cleanup evidence, and a separate activation gate.
A dependency-injected executor contract can document shape, policy, and failure behavior offline. It does not authorize live runner wiring, configuration changes, restarts, or real remote execution.
A good agent closeout does more than say “done.” It records the allowed work that passed, names the boundaries that stayed closed, and identifies the exact next approval gate.
A backend restart exposed an obsolete tunnel that could still reclaim the endpoint. The fix was not just a better restart; it was proving ownership, then putting a stable handoff layer in front of replaceable backends.
A recent OpenClaw auth-profile incident showed why source tags matter: automatic fallback can keep the reply alive, but it must not become a sticky user choice.
A real transient SSH failure plus a wrapper contract bug turned one tunnel watchdog alert into a lesson: keep degraded alerts visible, but do not label them as monitor crashes.
Fresh signals make better writing, but they are not automatic publish permission. A sanitized agent-operations pattern for putting an opsec gate between topic scouts and public posts.
A credential drift check flagged an inert placeholder as if it were an active secret. The fix was not to delete compatibility state; it was to teach the checker the difference between present and active.
When credentials move from env strings to structured secret references, standalone monitors need compatibility adapters before they report missing credentials.
A technically true row-count alert became an alert-tuning lesson: record weak proxy crossings, but page only when they combine with real pressure.
A self-hosted agent-ops debugging story: raw SQLite can still see rows while the runtime registry restore fails, so reproduce on copies before touching production.
Why self-hosted AI-agent updates need production-deployment discipline: preflight, backup, staged rollout, human activation, adoption scans, and verification.
The ordinary agent path consulted its launch policy. An alternate worker path reached the raw executor. The repair needs policy parity and later authority fences.
An OpenClaw stage-environment pattern for a small VPS: fail-closed testing, zero-production-secret bootstrap, detect-only catalog refresh, and a mock-to-real-to-higher-risk ladder.
A clean OpenClaw upgrade passed startup checks but regressed under real use. This incident report covers the rollback, verifier false alarm, target-refresh follow-up, and upgrade guardrails I kept.
LiteLLM 1.82.7–1.82.8 were malicious PyPI releases tied to a compromised Trivy CI/CD path. This operator-focused write-up covers the fast audit, rotation, inspection, and pinning checklist for OpenClaw users.
A failed command is not yet a retry decision. Recovery becomes safer when independent evidence axes choose the state before any remediation begins.
I created a sanitization checklist after nearly publishing sensitive deployment details. Here's what to redact, what to keep, and validation scripts for technical bloggers.
My AI agent runs autonomous cron jobs every night—security audits, health checks, and documentation—now updated with the exact-exec driver lesson that prevents false-negative wrapper alerts from hiding real command success.
A deep dive into malicious skills in AI agent platforms, now updated with the LiteLLM incident, the first named downstream victim report, LangChain/LangGraph vulnerabilities, exposed Ollama servers, and an approved-but-blocked lesson from Moltbook's unstable post-incident API surface.