monitor-security

Continuous Operation (Non-Negotiable)

This skill is always-on. It:

• Runs on its configured schedule indefinitely — it NEVER stops unless explicitly halted by the user
• The agent MUST NOT stop and wait for the human to ask for status or remember to check
• If a cycle fails, diagnose the failure, attempt auto-repair, and continue
• Only escalate to the human if genuinely blocked after exhausting /dogpile research
• Gracefully handles restarts and maintains state across cycles
• Is designed for multi-day/week/month autonomous operation

Anti-pattern: Reporting status and waiting for the human to ask "what next?" is UNACCEPTABLE. The agent must proactively fix issues and continue the monitoring loop.

Architecture

Hourly Threat Intel Loop (:00-:10)
  consume-feed → social-bridge → dogpile (if critical CVE) → threat_intel_digest.json

Nightly Self-Hack (00:30-03:00)
  00:30  Read threat_intel_digest.json → prioritize attack vectors
  01:00  T0: Deterministic (Semgrep, pip-audit, gitleaks, grep audits)
  01:15  T1: OWASP LLM Top 10 static analysis
  01:30  T2: Docker self-hack (build twin → /hack scan → score)
  02:00  T3: Cascade validation (T0→T1.5 GPT swarm→T2 Brandon)
  02:30  /battle (conditional — only if T2 critical findings)
  03:00  Report + /memory learn findings

Commands

./run.sh check [--tier N] [--probe NAME] [--autofix] [--json]
./run.sh dashboard
./run.sh fix <probe-name>
./run.sh threat-intel [--dry-run]
./run.sh register-nightly
./run.sh register-hourly
./run.sh help

Probe Tiers

Environment Variables

State

• ~/.pi/monitor-security/latest_report.json — Latest probe results
• ~/.pi/monitor-security/threat_intel_digest.json — Accumulated hourly threat intel
• ~/.pi/monitor-security/training_labels.jsonl — Brandon teacher judgments
• ~/.pi/monitor-security/shadow.jsonl — Shadow mode comparison log
• ~/.pi/monitor-security/report_t{0,1,2,3}.json — Per-tier reports