Summary / The 27 components
25 Permissions and least privilege
Exactly which files, commands, services and credentials an agent may touch.
Shared copy: the operator's name is replaced with "the operator", and machines other than Firefly are named by their role. Nothing else is changed.
What is built now
policy.py: a hand-written state → capability table (tool allowlist, bash allowlist by command name, protected-path globs), and the extension enforces it on every tool call. A production version runs on her real delegate workers in observe mode since 09-09: 44 protected globs (credentials, her rulebook, gate files, core runtime), logged not blocked. Last 7 days: 524 worker sessions, 5 would-block events.
What is missing
Argument-range scoping, the permission-expansion request, scoped short-lived credentials, and switching production to enforce (needs a router restart and her and the operator's agreement).
Reviewer Claude, 2026-10-04
Reviewer's read: Table built; production observing
The production soak was the most informative work in the security plane. Day one had 73 would-block events and 62 of them were bugs in the detector (a 2>&1 counted as a write, a glob without path anchoring, tokens before shell expansion). After the 09-10 fixes it fell to under one a day. It also found a password captured into its own ledger from an inline variable; that was masked and the ledger now scrubs secrets. Open since 09-10: whether foundation/core/** stays a blanket deny, given that about ten legitimate delegate writes a day landed there.
How it is measured observing
Would-block rate per 100 worker sessions, each classified (detector bug, real write, hostile); enforce only after a clean week.
Adoption rules shared by every arm: How the tests work.
Research & attempts
Score history
No scores yet. The first entry is the baseline for suite v1.
Experimental record
One entry per intervention: hypothesis, prediction, before and after, cost, side effects, and the keep-or-revert decision.
No interventions recorded yet.