Skip to content
CoS Knowledge
Esc
↑↓navigate↵open⌘Jpreview
On this page

Flue-based CoS Design — Review

Review date: 2026-09-05. Input: flue-artifact-co-s-architecture-v0.2.md (“Personal Chief of Staff — Architecture Plan, Draft v0.2”). Stack under review: Flue (agent harness) → Cloudflare Workers / Agents SDK, with Termux (Android) and Macro.com MCP (~67 tools) as the action surfaces. Verdict first: architecture is sound and maps cleanly onto what we already operate today; the burst of risk is in the “full autonomy, no approval gate” posture, the Termux bridge surface, and a context store that would drift from stores we already own.

1. What’s right (and matches reality we’ve already validated)

  1. One brain + subagent bench = the operating model we run now. Our CoS today: one context (pass + context/ + skills/ + jobs/), delegated work, decision capture. The artifact formalizes exactly this.
  2. Harness-first (skills over code). Behavior in SKILL.md/skill files, not hardcoded prompts — this is our skills/ convention; editable without redeploy = the right tuning loop.
  3. Durable, append-only execution. Durable Streams + resumable runs directly answer the incident we had: the AutoTask SMS that returned ok:true at the brain layer and never hit the modem. An append-only audit trail with replay is the correct load-bearing design for “acted on your behalf.”
  4. The two surfaces are the ones we proved. Macro MCP (verified live: macro-tools v0.1.0, 67 tools, search_docs/facets working) and Termux device layer (verified: termux-sms-send, sshd bridge) are real, working integrations — not hypotheticals.
  5. Phased plan with read-only start. Phase 1-2 “read-only to start” is the right instinct and is the recommendation I’d shave down to below.

2. Critique — the load-bearing risks

2.1 “Full autonomy, no human-in-the-loop gating” is wrong as a default

This contradicts the operating policy in force for this CoS (confirm before external side effects: sends, purchasing, bookings, account changes) and was the shape of the SMS failure — a silent execution never surfaced for review. “Log it, don’t gate it” only works after trust is earned, and the doc’s own guardrails are deferred to Phase 3. Change: replace “no approval gate” with an approval matrix by action class (default approve: reads, drafts, reminders, file writes to the knowledge base; confirm: send-to-anyone, delete, spend, book, credential change). Autonomy = approved standing rules, not unmitigated execution. Keep audit log always-on either way.

2.2 The Termux bridge is a high-risk surface and seen as a detail

Device Agent executes on-phone actions via Termux — that’s arbitrary shell on Derrick’s device. Today this is an SSH daemon bound on LAN (port 8022 + saved key). As designed it’s the Crown Jewel for an attacker and a single footgun for the agent.

  • Scope it: a command allow-list (only termux-sms-send-family, notification, forensics); no general bash identity in the bridge.
  • Do not expose sshd beyond the LAN; use Cloudflare Tunnel/WireGuard outbound so the Worker reaches the device without a listening port.
  • Per-device secrets and key rotation; log every command with caller agent id.

2.3 The Context Store threatens a second brain

D1 + Vectorize + KV is a real stack, but “one context layer” will drift from the system that is the source of truth today: the git repo + Blume site + knowledge-graph.json (id/type/facet contract already live). Two brains = contradictions, which is exactly the failure mode the doc claims to avoid.

  • Delegate: long-term/memories → git knowledge base (already typed + graph exportable); runtime state + audit = D1/KV-backed Flue streams; Vectorize embeddings over the SAME knowledge-graph.json + llms-full.txt for recall. Map pass for secrets; never sync secrets into D1.
  • Keep id/type/category/status/tags as the shared schema between the knowledge base and the store.

2.4 Concurrency = action races

Parallel subagents with real write tools (reschedule + email + CRM update concurrently) mutate shared entities; the “audit log” only records the outcome.

  • Single-writer lock per entity (per contact/deal/event) or serialize per entity in the Worker; ormerge plans before execution.

3. What’s missing from v0.2

  • Incident response: what halts a run? (tripwire = guardrail match stops further actions, alarm to human). Missing.
  • Model choice / cost bounds per agent (Cloudflare Workers AI vs gateway; per-agent token budgets).
  • PII hygiene in logs: Termux commands and MCP payloads embed personal data; define redaction at log-write.
  • Macro auth works, but the server’s OAuth metadata is spec-broken (missing RFC 9728 resource); token refresh + key rotation path should be designed-in (we run the manual PKCE workaround today).
  • Channel identity: who is “you” (Telegram, Push) — harden identity/authentication of human instructions at the ingress.

4. Suggested delta to v0.2 (concrete)

  1. Rename “Autonomy: Full” → “Autonomy: Approval-matrix default; escalate by class” (classes + default table in autonomy-guardrails.md).
  2. Phase order change: (0) scaffold on Flue; (1) read-only Macro integration + nightly briefing cron (existing morning-briefing content flow!); (2) audit-log viewer + tripwire; (3) Termux bridge with allow-list + tunneled transport; (4) comms/tasks agents read-only; (5) plans & guardrails review gate; then (6) first write surfaces (sends) per class.
  3. Context store = façade over existing stores (pass / git / knowledge-graph.json; D1 with runtime + audit; Vectorize on the same artifacts).
  4. Wire decisions log to what we already do: every meaningful action keeps an entry in a decisions surface (like the existing context/ audit), plus Durable Streams replay.
  5. Use knowledge-graph facets: subagents retrieve context via the MCP search_docs(filters) path the site already exposes — fewer bespoke store reads.

5. Bottom line

Adopt — after editing: the three fixes I’d demand before any write: approval-matrix default, allow-listed+outbound Termux bridge, and context-layering that reuses the git knowledge base instead of cloning it. Then the phased plan is right and near-darn buildable on the exact surfaces we’ve already proven. The artifact, stored here, is v0.2; mark it “v0.3 — CoS review applied”.

Filed: /Users/hodgeluke/Code/cos-knowledge/Ideas/ (gitignored; not published).

Was this page helpful?