Securing and operating agents
Workstations, orchestration, identity, and the boundaries around autonomous tools.
Building Frank
Follow the implementation, from bare metal to working services.
Secrets Management — Infisical + External Secrets Operator
Replacing the SOPS-only secrets workflow with Infisical + ESO — and the three Infisical chart bugs that forced splitting one app into three.
Agentic Control Plane — Sympozium
A Kubernetes-native control plane where every AI agent is a Pod, every policy is a CRD, and every execution is a Job — orchestrated by Sympozium.
Unified Auth — Authentik SSO for the Entire Cluster
One identity provider for every service — Authentik brings OIDC SSO to ArgoCD, Grafana, and Infisical, forward-auth proxy to Longhorn, Hubble, and the Tekton Dashboard, and OIDC-backed kubectl access.
Paperclip — An AI Agent Orchestrator on Frank
Deploying Paperclip — an AI orchestrator that organises agents into virtual companies with org charts and budgets — alongside Sympozium, to compare two fundamentally different agentic paradigms.
Persistent Agent — A Kali Workstation on Kubernetes
Deploying a persistent Kali Linux container on gpu-1 as an always-on Claude Code workstation — because laptops sleep and mobile apps have limits.
Secure Agent Pod — Hardening an AI Coding Workstation
Rebuilding the Kali workstation as a hardened, non-root pod with layered defenses — because giving an AI agent skip-permissions demands more than trust.
VK Relay — Tunneling the Browser to a Local Agent Server
Deploying a relay server sidecar to tunnel the VK remote web UI through to the local agent's workspace data — because a dashboard that cannot show your work is not a dashboard.
VK Remote — Self-Hosting the Kanban Backend Before the Cloud Dies
The VibeKanban cloud announced shutdown with 30 days' notice. This is how we deployed the self-hosted remote crate — PostgreSQL, ElectricSQL, and a Rust API — before the lights went out.
Ruflo — A Swarm Orchestrator Next to Paperclip
Standing up ruvnet's claude-flow as a 24/7 hybrid pod — a ruvocal web UI plus a shell sidecar — to run as the chaotic-swarm counterpoint to Paperclip's org-chart agents.
Rebuilding the Hermes Shell on the Official Image, With a Hindsight Memory Sidecar
Retiring the custom agent-shell image and rebuilding hermes on Nous Research's official hermes-agent image as a three-container pod — bare official image, an SSH sidecar, and a self-hosted Hindsight memory backend.
Operating on Frank
Check health, investigate failures, and recover the system.
Operating on Secrets
Day-to-day commands for managing secrets in Infisical, checking ESO sync status, handling SOPS-encrypted bootstrap secrets, and recovering from the real gotchas that have bitten us.
Operating on Authentication
Day-to-day commands for managing Authentik SSO, checking OIDC flows, rotating client secrets, and debugging the forward-auth redirect loop that redirects to 0.0.0.0.
Operating on Secure Agent Pod
Day-to-day commands for managing the secure agent pod — SSH access, process health, s6-overlay supervision, VibeKanban, GitHub App token auth, and recovering from the gotchas we've shipped.
Operating on Paperclip
Checking Paperclip health, database access and secret sync, handling the RWO PVC constraint, and bootstrapping the pure-upstream instance after the 2026-10 fresh start.
Git Credentials Without a Shell
Why $GITHUB_TOKEN is set in your terminal but missing in VS Code's git — and a credential helper that fixes it permanently by reading /proc/1/environ.
Operating on VK Relay
VK relay server health checks, tunnel status, re-pairing, and troubleshooting the browser-to-agent connection.
Operating on VK Remote
Self-hosted VK Remote stack — PostgreSQL health, ElectricSQL sync status, API verification, and troubleshooting.
Operating on Ruflo
Connecting via SSH/Mosh, curating the inventory ConfigMap, bumping images, backups, and a worked swarm-run cookbook.
Operating the Hermes Shell With Its Hindsight Memory Sidecar
Checking the Hindsight memory sidecar's health, the two-tier memory backup story, the claude-code retain provider, and the pg_restore mechanic.
The Frank Papers
Compare approaches, examine the evidence, and understand the trade-offs.
Secrets Management Without the Bootstrap Chicken-and-Egg
Secrets management is a five-job problem — storage, distribution, rotation, audit, and the bootstrap chicken-and-egg — and the six contenders in 2026 (Infisical, ESO +…
Identity for a Heterogeneous Stack
Ten web UIs, three CLIs, and a gRPC service all want to ask the same question: who's on the other side of this URL? The identity-provider slot has seven serious vendors —…
Agentic Orchestration & Safe Agent Workstations
Agent orchestration is a four-job problem — isolation, persistent state, access, and fleet dispatch — and the six contenders in 2026 (secure-agent-pod, VibeKanban, Paperclip +…