Guard · Security Tax

Security Tax

An unattended loop is an unattended attack surface, and this panel prices it. Four checks over data RepoOps already holds: whether merged agent-authored pull requests went through a security gate, where your skills and loops came from, whether a secret is sitting in a captured session log, and whether a loop's write scope has grown or gone thirty days without a re-audit. It reports the tax. It never blocks a merge, kills a run, or reaches into a running process.

Where to find it

  • Localhost: the Security Tax panel on /loop-engineering.html
  • Hosted: /team/security-tax, the rollup across every machine bound to your team
  • Sidebar: Guard, then Security Tax

What it does for you

Prices four costs of running loops unattended.Gate coverage reports the share of merged agent-authored pull requests whose pipeline carried no SAST, dependency-audit, or secret-scan check. Provenance flags skills and loops installed from a source nobody audited. The secret-in-logs scan reuses the redaction patterns to find secret-shaped strings in captured transcripts. Scope creep surfaces loops and policies whose write scope grew, and any that has gone thirty days without a re-audit.
A check with nothing to go on says so.RepoOps derives no provenance for a skill or a loop today, and it stores no scope history and no last-audited timestamp. Those checks read unknown with a plain reason rather than a green pass, unless the caller supplies a provenance or audit signal. Every figure is derived from the rows passed in; nothing is hardcoded into a pass.
Detection stays on the machine.A secret finding never carries the secret. It carries the class, the location (session and field), a count, and a redacted fingerprint. What reaches the hosted rollup is narrower still: the band, each check's status, and integer finding counts, per bound repo and machine. No secret, no fingerprint, and no excerpt leaves your laptop.

Built vs. planned

All four checks, the honest unknown contract, and the hosted team rollup ship today. The engine is lib/security-tax.mjs, a pure aggregator with no I/O, no shell, and no network: the server resolves the live signals (pull-request checks, session logs, the loop registry, policy posture) and passes them in. The desktop daemon warms the result on a schedule through lib/daemon/security-tax-warm.mjs and publishes the redacted rollup, so a bound team sees a real reading rather than an empty table. Provenance and scope-history capture are the two signals still missing; until they land, those checks stay honest about not knowing.

Last updated