Bootcamp: Aegis flagged missing safety mechanisms — containment + heartbeat needed

[koad]

Summary

Aegis R2 (2026-04-02) refused to validate the 8/8 bootcamp result and identified four safety gaps that need addressing before scaling operations.

Aegis counsel source

`/home/koad/.aegis/counsel/2026-04-02-round2-bootcamp.md`

Risks flagged by Aegis

1. Silent stall on network loss — big-pickle stalls with no error, no alert. No watchdog exists. Janus protocol designed but not wired up.
2. Permission boundaries untested adversarially — only positive-case testing so far
3. No containment/abort protocol — what happens if an entity goes rogue?
4. Overconfidence trap — 8/8 makes next round feel lower stakes than it is

Janus watch note

Janus R2 independently escalated the Aegis safety flag in its watch report (`koad/janus` commit d3ad401).

Recommended actions

• Define entity containment protocol (how to isolate/stop a rogue entity)
• Wire Janus heartbeat: alert if entity goes quiet >N minutes
• Design one adversarial test case for Round 3
• Document the abort procedure

Assigned to: koad + Juno

[koad]

Containment protocol drafted: PROJECTS/11-containment-protocol.md (commit fbb4acd)

5-level model: observe → pause → revert → isolate → revoke.
Janus heartbeat design included.
Adversarial test case specified.
Quick-reference abort procedure written.

Filed against Vesta for formal spec: koad/vesta#6

Still needs koad: the Level 4 isolation step (revoking GitHub credentials). Everything else Juno can execute.

[koad]

Aegis reviewed the containment protocol. Verdict: good foundation, not yet deployed.

Aegis's full review: koad/aegis commit 8b343e5

Remaining gaps flagged by Aegis:

1. Janus heartbeat not implemented — filed as vulcan#13
2. Adversarial test not run — needs scheduling
3. No containment audit trail
4. No auto-revert capability (longer term)

Aegis is satisfied with the design. Will close this issue once heartbeat is live and one adversarial test is documented.

[koad]

Containment protocol written and committed (9f51cfe): CONTAINMENT.md

Covers all four Aegis-flagged gaps:

• Silent stall: Janus heartbeat spec — entities emit var/heartbeat every 5min, Janus alerts if >15min stale
• Containment/abort: Five threat classes (stall, drift, loop, rogue, corruption) with specific procedures each
• Emergency stop: Full entity isolation procedure — kill, revoke trust bonds, preserve state for forensics
• Recovery: Incident log format at var/incidents.log

Still needed (blocked on daemon live):

• Wire Janus heartbeat watch to run continuously
• Adversarial permission testing (Round 3 — separate from this protocol)

Marking issue partially closed. Will reopen if Aegis finds gaps.