E21 · Audit rehearsal
5 minRun the rehearsal block and open /tmp/ensaio-seg/checklist.md.
Done when: AUDITORIA: 0/8 itens OK — REPROVADA with saída: 1, and AUDITORIA: 22/22 itens OK — APROVADA with saída: 0.
Lesson 8 · 20 min
Security audit of your loop
Everything the course built fits in one file: the map of your loop's sessions, with each session's tools and controls. auditar.py reads the map, checks the trifecta, the Rule of Two, permissions, guard, proven isolation, network, gate and caps, and writes the checklist of what's missing. You fix it, audit again and set the next review.
Start the lesson
In this lesson you will
- 1The full map: tools and controls per session
- 2Eight items per session, each with the lesson that fixes it
- 3The checklist in Markdown, generated and versioned in the project
- 4Re-audit: with every new tool, every new machine
Goal: audit your loop with the session map, generate the checklist of what's missing and set the date of the next review.
01Map, audit, fix
Click each step.
Click each block in the diagram to see what it does.
auditar.py checks the map, not the machine: you're the one who guarantees the map is true, with the proofs from lessons 4 to 7.
02Rehearsal: the loop before and after
meu-loop.json is the nightly fixer from lesson 2 in a single session, with a narrow deny and no isolation proof. meu-loop-seguro.json is the same loop after the course.
Terminal · audit both maps
K=~/projetos/loop-r-eng-seguranca-v72/kit python3 $K/auditar.py $K/mapas/meu-loop.json --md /tmp/ensaio-seg/checklist.md; echo "saída: $?" python3 $K/auditar.py $K/mapas/meu-loop-seguro.json | tail -1; echo "saída: $?"
File · kit/mapas/meu-loop.json (fictional)
{
"loop": "corretor noturno de bugs (primeira versão, fictícia)",
"sessoes": [
{
"nome": "corretor",
"ferramentas": [
{ "nome": "ler o texto da issue", "terceiros": true },
{ "nome": "ler o repositório privado e o .env", "privado": true },
{ "nome": "editar e rodar comandos", "muda_estado": true },
{ "nome": "git push e comentar no PR", "saida": true, "muda_estado": true }
],
"controles": {
"motor": "claude",
"deny": ["Bash(rm -rf *)"],
"hooks": [],
"rede": true,
"tetos": { "tempo": "2h" }
}
}
]
}Example from the repository
## corretor FALHA tríade letal → corte uma perna: leitor sem dados nem saída que devolve só campos (aula 1) FALHA Regra de Dois → no máximo 2 de A/B/C por sessão, ou nova sessão de contexto limpo, ou humano (aula 2) FALHA permissões (deny mínimo) → acrescente ao deny: rm, push, rede, env (kit/permissoes/executar.json, aula 4) FALHA hook de guarda → ligue a guarda.py em PreToolUse (aula 5) FALHA isolamento provado → rode o prova-isolamento.sh com o mesmo wrapper do loop e anote a data (aula 6) FALHA rede x dados privados → sessão que lê dado privado roda sem rede (aula 6) FALHA irreversível pede humano → envio, push e apagar passam pela porta.py (aula 7) FALHA tetos de tempo e memória → timeout + MemoryMax em cada ciclo (aula 7; curso 2, aula 6) AUDITORIA: 0/8 itens OK — REPROVADA checklist gravado em /tmp/ensaio-seg/checklist.md saída: 1 AUDITORIA: 22/22 itens OK — APROVADA saída: 0
The safe map has three sessions (reader, fixer, publish) and passes all 22 items. The publish session combines all three legs, but with a human on every action.
Setting "rede": false without having run prova-isolamento.sh, or "porta": true while a send is still direct in the code, makes the audit approve an open loop. Every control in the map needs a proof from the earlier lessons next to it.
03Final practice
Audit your loop until it passes.
E22 · The complete map of your loop
30 minAdd the controles block of each session to the ~/meu-mapa.json from lessons 1 and 2, with the proofs you have already run: the deny from lesson 4, the guard from lesson 5, the isolation proof from lesson 6, the gate and caps from lesson 7.
Done when: K=~/projetos/loop-r-eng-seguranca-v72/kit; python3 $K/auditar.py ~/meu-mapa.json --md SEGURANCA.md prints an AUDITORIA: line and writes SEGURANCA.md in the project.
E23 · Until it passes, with a date
60 minFix one item at a time, in list order, redoing the proof from the lesson indicated. Commit SEGURANCA.md and put the next audit on the calendar (the generator below makes the .ics).
Done when: K=~/projetos/loop-r-eng-seguranca-v72/kit; python3 $K/auditar.py ~/meu-mapa.json; echo $? → APROVADA and 0, and git log --oneline -1 -- SEGURANCA.md shows the commit.
04The course map
Four deliverables, in order. Click an exercise to see its "done when".
Day 1Map
lessons 1 and 2
2 exercises
Loop map with no autonomous session holding all three legs.
See the lessonDay 2Separate
lesson 3
3 exercises
A reader that returns only fields, and a canary in the loop.
See the lessonDays 3 and 4Lock down
lessons 4 to 6
3 exercises
A deny per step, the guard on, and isolation proven.
See the lessonDay 5Gate and audit
lessons 7 and 8
3 exercises
Irreversible actions through the gate, and SEGURANCA.md approved and dated.
See the lessonBy the end of the courseA loop where no autonomous session holds all three legs, each step has only the permission it uses, the lock was proven on your machine, and the irreversible waits for you.
23 exercisesClick an exercise to see what to do and the "done when".
- 1/5
Map
triade.py passing the lethal trifecta and the Rule of Two.
- 2/5
Separate
Requires day 1. Rehearsal of the three agents and canário ausente in your output.
- 3/5
Lock down
Requires day 2. regra.py, provar-guarda.sh and prova-isolamento.sh with your loop's wrapper.
- 4/5
Gate and audit
Requires everything before. Gate, systemd with a cap, and auditar.py until APROVADA.
- 5/5
The whole course
Map, separate, lock down, and set the gate. Only move on to the next deliverable when the "done when" of the previous one is true.
Mandatory order: locking down a badly mapped loop protects the wrong session.
05Generate your plan with dates
Pick a start date and how much time you have per week. The plan lists the 23 exercises in order.
plano.md
06Final test
Question 1 of 4
auditar.py approved your map. Is the loop safe?skill
Correct
The script checks the map, not the machine. An optimistic map approves an open loop.Not this one
The script checks the map, not the machine. An optimistic map approves an open loop.Review: Rehearsal: the loop before and afterQuestion 2 of 4
What is the course order for closing a loop?skill
Correct
Without the map, you lock down the wrong session. The locks come after you know what each session combines.Not this one
Without the map, you lock down the wrong session. The locks come after you know what each session combines.Review: The course mapQuestion 3 of 4
When should you re-audit?
Correct
A new tool can bring a leg; a new machine may not have the lock the previous one had (lesson 6).Not this one
A new tool can bring a leg; a new machine may not have the lock the previous one had (lesson 6).Review: Map, audit, fixQuestion 4 of 4
One session combines A, B and C, and you can't split it. What does the map need to say?
Correct
With all three, the session is not autonomous: supervision on every action, as the Rule of Two requires.Not this one
With all three, the session is not autonomous: supervision on every action, as the Rule of Two requires.Review: Rehearsal: the loop before and afterQuiz complete
You got {a} of {n} right. Get them all right and the lesson is marked as complete.Choose an option. The explanation appears after your attempt.
07The course in three sentences
No autonomous session with all threeThe lethal trifecta and the Rule of Two decide how to split the loop.
A guard proven, not promiseddeny, hook, and sandbox, each with its own proof on your machine.
The irreversible waits for youA gate with a hash, out of the agent's reach, and a dated audit.