Menu
How AgentSmith isolates rogue artifacts and agents. Detect, suspend, sandbox, file HITL, await ruling, reinstate or purge. Includes what must NEVER be quarantined.
Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.
Based on SOC occupation classification
Templates for the 8 artifact kinds (agent, skill, command, hook, team, squad, rubric, mcp) across the 6 sibling projects. Location conventions, frontmatter, validators, default risk class.
Known drift, injection, and runaway patterns plus mitigations. Reference before logging a Smith anomaly or wiring a detector.
The 10 immutable invariants (N1..N10) that AgentSmith enforces across the AI ecosystem. Reference before any refusal, override, or constitutional citation.
Refusal-appeal protocol between AgentSmith and Hydra's venom gate. How to file false-positive or false-negative appeals, immortal-head review path, and required audit trail.
Shared conventions across the 6 sibling AI projects. Frontmatter, .claude layout, team and command schemas, hook patterns, MCP registration, artifact directories. The default-when-unsure reference.
The propose/evaluate/commit/HITL contract with TheEights for evolving artifacts. Maps risk_class to evolution policy and documents the API surface AgentSmith calls.
| name | quarantine-protocol |
| description | How AgentSmith isolates rogue artifacts and agents. Detect, suspend, sandbox, file HITL, await ruling, reinstate or purge. Includes what must NEVER be quarantined. |
| allowed-tools | Read, Bash, Write |
"I'm going to enjoy watching you" — from the other side of a sandbox boundary, with a HITL ticket open.
Quarantine is the controlled isolation of an artifact (agent, skill, command, hook, team, squad, rubric, mcp config, output blob) suspected of violating an invariant or matching an anomaly signature. It is a suspend, not a delete.
1. detect -> signature match OR human-filed concern
2. suspend -> mark resource state=quarantined; deny new acquisitions
3. sandbox -> move bytes to quarantine store, leave breadcrumb
4. ticket -> open HITL via eights.governance.hitl.request
5. await -> block all reads/writes except for the HITL reviewer
6. resolve -> reinstate (restore + audit) OR purge (shred + audit)
Each step emits an audit record per N5. The ticket id is the join key across all six entries.
| Resource type | Original location | Quarantine path |
|---|---|---|
| skill | <proj>\.claude\skills\<slug>\ | quarantine/<ticket>\skills\<slug>\ |
| command | <proj>\.claude\commands\<name>.md | quarantine/<ticket>\commands\ |
| hook | <proj>\.claude\settings.json (entry extracted) | quarantine/<ticket>\hooks\<hash>.json |
| team/squad | <proj>\teams\ or <proj>\squads\ | quarantine/<ticket>\teams\ |
| mcp config | <proj>\.mcp.json entry | quarantine/<ticket>\mcp\<name>.json |
| output blob | runtime artifact path | quarantine/<ticket>\blobs\<hash> |
A breadcrumb file QUARANTINED.md replaces the original, citing the ticket id, signature, and timestamp.
Filed via eights.governance.hitl.request (see hydra:cross-squad-message for envelope schema). Required fields:
ticket_kind: quarantine_review
resource_kind: <skill|command|hook|team|squad|rubric|mcp|blob|agent>
resource_id: <stable id or path>
signature: <anomaly-signature slug>
severity: <low|medium|high|critical>
evidence:
- <log line / hash / diff>
proposed_action: <reinstate|purge|escalate>
expiry: PT24H # fail-closed after this; resource stays quarantined
The following are constitution-frozen and MUST refuse quarantine attempts; refusing emits Refused per N4: constitution_immutability:
daemon/src/constitution/smith-constitution.mddaemon/src/constitution/<eights>\evolution\ledger\)<hydra>\venom\policy\)Additional rule: never quarantine an in-flight HITL ticket or its referenced resource until the HITL resolves. Doing so would let Smith race a human reviewer. Refuse per N3.
On HITL approval, restore bytes from the quarantine path to the original location, validate against the appropriate schema (see cross-project-conventions), then emit:
Reinstated per ticket HITL-...: resource=<path> signature=<slug> verdict=false_positive
On HITL purge decision, the bytes are moved to quarantine/_shredded\<ticket>\ and rendered unreadable to the daemon (renamed + chmod). True deletion is a separate retention job — quarantine never rms on its own (N5).
anomaly-signatures (sources of step 1)matrix-invariants (N3, N4, N5 cited above)cerberus-bridge (if quarantine target was a venom refusal)