suwappubot: Skill for Claude Code

/aegis-goal — Ship the AEGIS integration, all phases

Standing goal: every phase of docs/plans/aegis-fork-extend.md implemented, verified, and merged. The plan (2026-08-02) adopts gaiarobotics/aegis (MIT, fork-pinned) as Suwappu's agent immune system: Python scanner at the LLM/message choke points, quarantine federated with BlacklistService, a minimal TypeScript port for the api-ts agent surfaces, plus standalone hardening fixes the research surfaced. Upstream reference commit: e3e87b3.

How to use

• /aegis-goal — pick the next unchecked item in phase order, re-verify its file:line anchor against current code (the plan is a point-in-time audit; lines drift), implement it, run the phase's verification, check it off, and commit the edit to this file in the same PR as the work.
• /aegis-goal <phase|item> — jump to that phase or item (e.g. /aegis-goal 2 or /aegis-goal 3.3).
• One phase ≈ one PR via /ship. Don't batch phases. Items within a phase may split into smaller PRs if independently shippable.
• When implementation reveals a new gap (like Phase 4's items were found), ADD it here under the right phase.
• Goal is DONE when every box is checked; then archive this skill (delete the directory in a final commit noting completion).

The backlog

Phase 1 — Python scanner at LLM + message choke points (observe mode)

SHIPPED: PR #685 merged to main (58b24f0), CI green, 58 tests, cubic review findings addressed. Deploy to Railway is still pending — auto-deploy is broken (billing) and the CCR session has no Railway credentials; run /deploy prod python-api from a machine with the Railway CLI, then python3 scripts/status.py to verify boot. 1.7b's telemetry clock starts at that deploy.

• 1.1 Pinned aegis-shield to immutable upstream commit e3e87b3791fb… in requirements.in + pip-compile'd lockfile (minimal diff; all 3 hard deps already present). Verified clean-venv install + scan smoke test. Manual follow-up: session repo-scoping blocked creating the 0xsoftboi/aegis fork — fork on GitHub when convenient and repoint the requirements.in URL (same SHA).
• 1.2 bot/config/aegis.yaml (observe, scanner-only modules, block_on_threat: false) + bot/config/aegis_signatures/crypto.yaml (14 SW-* signatures) + bot/services/aegis_service.py (fail-open singleton wrapper, WARNING-log mirror for Railway) + AEGIS_ENABLED setting. Verified: pack loads (52 sigs total), 14/14 detection cases pass, p50 0.22ms.
• 1.3 DONE (commit 3618d9b) — LLM pre-flight: Shield.scan_input() in parse_trade_intent (bot/services/nl_intent_service.py:404, before the Anthropic call); provenance-delimit untrusted text in _build_user_content (:214-216); sanitize the pending_intent echo (:182-192 — injection persistence loop).
• 1.4 DONE (commit f8d896b) — WhatsApp seam: scan in _wa_dispatch (api/main.py:2512-2531) — must cover text, button payloads, nfm_reply JSON, and post-Whisper voice transcripts (:2522-2524).
• 1.5 DONE (commit ee4747b, group -1 at top of add_handlers) — Telegram seam: group -1 scanner handler in bot/main.py add_handlers (before :740) or wrap PerUserSerializingProcessor.do_process_update (bot/utils/update_processor.py:25). Scan-and-log only — never blocks normal commands.
• 1.6 DONE (commit f8d896b, 30/60s per-key limit + scan) — Agent NL API api/main.py:2163-2183: add scanner + per-key rate limit (today it has neither between the API-key check and handle_command).
• 1.7a Code gate DONE (commit 59a0bc2): 57 tests pass (19 AEGIS + 38 NL incl. 6 new prompt-hardening), p50 scan latency 0.12ms. Suite caught+fixed a real bug (ThreatMatch flat-field access blanked signature_ids telemetry).
• 1.7b Telemetry review: after Phase 1 deploys, review observe-mode detections (Railway logs AEGIS threat detected + .aegis/telemetry.jsonl) after ~1 week of prod traffic before any enforce flip anywhere.