huytieu/COG-second-brain

Review signals: 1 connection review, 1 sensitive read.

Repository processes attempted these non-loopback connections; proxies can hide the final hostname. 2 distinct locations. 4 attributed processes.

A repository process attempted to read this sensitive path. <guest-path> 4 attributed processes.

OSV scanned supported lockfiles; unpinned dependencies and unsupported formats are outside this check.

A short run cannot establish that code is safe.

Connections show IP addresses; proxies can hide the final hostname.

Tracing covers dispatched commands and their children, not the whole OS; guest root can interfere with tracing.

Full safety evidence →

• slop-gate refuses slop tells in outgoing text and runs in CI or as a hook: Real input produced the expected result: clear

  Source: Refuse slop tells in anything about to be written, published, or sent; runs in CI or as a hook

  Input: /tmp/cog-samples/clean.md (a clean one-line draft)

  Expected: scanner reports clear and exits 0

  Command: python3 .claude/skills/slop-gate/scripts/scan.py /tmp/cog-samples/clean.md

  Observed: clear

• validate-agent-surface catches drift between manifests, docs, and shipped files: Real input produced the expected result: Validation passed with 0 warning(s)

  Source: Before publishing or updating framework files, run `./scripts/validate-agent-surface.sh` to catch drift between manifests, docs, and shipped files.

  Input: the shipped repo at the pinned commit

  Expected: validator prints Validation passed with 0 warning(s)

  Command: ./scripts/validate-agent-surface.sh

  Observed: Validation passed with 0 warning(s)

Examples

• Install COG skills via skills.sh (README installer), run non-interactively into an empty directory outside the checkout: command completed successfully

  Source: README.md Quick Start: npx skills add huytieu/COG-second-brain

  Input: huytieu/COG-second-brain --agent claude-code -y in /tmp/cog-npx-install with Node 22 on PATH

  Expected: skills copied under ./.claude/skills

  Command: /usr/bin/npx --yes skills add huytieu/COG-second-brain --agent claude-code -y

  Observed: n: Edit drafts into sharper, more human writing while preserving the … ^ ⚠ Skipped /tmp/skills-DPsZ20/.claude/skills/review-cockpit/SKILL.md — YAML parse error: Nested mappings are not allowed in compact mappings at line 2, column 14: description: Produce and continuously maintain ONE living review document for a… ^ ⚠ Skipped /tmp/skills-DPsZ20/.claude/skills/slop-gate/SKILL.md — YAML parse error: Nested mappings are not allowed in compact mappings at line 2, column 14: description: Deterministic pre-publish scan that refuses AI-slop tells in anyth… ^

• Check for upstream COG updates without changing files: command completed successfully

  Source: README.md Keeping COG Updated: ./cog-update.sh --check

  Input: --check

  Expected: reports local and upstream version and that everything is up to date

  Command: ./cog-update.sh --check

  Observed: COG Upstream Update ───────────────────── ℹ Fetching latest from cog-upstream/main... ℹ Local version: 3.16.0 ℹ Upstream version: 3.16.0 ✓ Everything is up to date! (v3.16.0)

Local or hosted: local

Run COG's documented checks and its deterministic slop-gate scanner: validate the packaged agent surfaces, check for upstream updates, scan a draft for AI-slop tells (exit 1 with findings, exit 0 when clear), and install the skills via the README's npx skills.sh installer.

cd <guest-path> && pwd && ls -la && id -u && python3 --version && cat /etc/os-release | head -3 && (git status 2>&1 | head -2)
cd <guest-path> && find . -maxdepth 2 -not -path './.git*' | head -100 && echo ---- && cat README.md 2>/dev/null | head -200
cd <guest-path> && sed -n 200,400p README.md
cd <guest-path> && ls scripts .coldpass && grep -n '```' README.md | head -80 && cat COG-VERSION
cd <guest-path> && git init -q && git remote add origin https://github.com/huytieu/COG-second-brain && timeout 120 git fetch --depth 1 origin 144c7a3a959cc99538b7dfee9c22c4b065a0e156; echo rc=$?; git reset --mixed FETCH_HEAD 2>&1 | tail -3; git log --oneline -1 2>&1; git status --short 2>&1 | head -20
cd <guest-path> && head -40 scripts/validate-agent-surface.sh && echo ---- && head -60 cog-update.sh && echo ---- && grep -n 'usage\|--check\|--dry-run\|--help' cog-update.sh | head -20
cd <guest-path> && ./scripts/validate-agent-surface.sh; echo rc=$?
cd <guest-path> && timeout 200 ./cog-update.sh --check; echo rc=$?
command -v node npm npx sudo; node --version 2>&1; npm --version 2>&1; sudo -n true && echo SUDO_OK; cat /etc/os-release | grep VERSION_ID; cd <guest-path> && git remote -v && grep -n 'skills add\|npx' README.md SETUP.md | head
(sudo -n apt-get update -qq && sudo -n DEBIAN_FRONTEND=noninteractive apt-get install -y -qq nodejs npm) > <guest-path> 2>&1; echo rc=$?; tail -5 <guest-path>; node --version; npm --version
mkdir -p /tmp/cog-npx-install && cd /tmp/cog-npx-install && export NODE_USE_ENV_PROXY=1 && timeout 300 npx skills add huytieu/COG-second-brain </dev/null > <guest-path> 2>&1; echo rc=$?; tail -c 3000 <guest-path>
mkdir -p /tmp/node22 && cd /tmp/node22 && export NODE_USE_ENV_PROXY=1 && timeout 300 npm install --prefix /tmp/node22 node@22 > <guest-path> 2>&1; echo rc=$?; tail -3 <guest-path>; B=/tmp/node22/node_modules/.bin/node; ls -la $B; $B --version
cd /tmp/cog-npx-install && export PATH=/tmp/node22/node_modules/.bin:$PATH NODE_USE_ENV_PROXY=1 && node --version && timeout 400 npx --yes skills add huytieu/COG-second-brain </dev/null > <guest-path> 2>&1; echo rc=$?; tail -c 3000 <guest-path>; echo; ls -la /tmp/cog-npx-install
cd /tmp/cog-npx-install && export PATH=/tmp/node22/node_modules/.bin:$PATH NODE_USE_ENV_PROXY=1 && timeout 400 npx --yes skills add huytieu/COG-second-brain --agent claude-code -y </dev/null > <guest-path> 2>&1; echo rc=$?; sed 's/\x1b\[[0-9;?]*[a-zA-Z]//g' <guest-path> | tail -c 1500; echo; find /tmp/cog-npx-install -maxdepth 3 | head -30; find /tmp/cog-npx-install -name SKILL.md | wc -l
cd <guest-path> && ls -R .claude/skills/slop-gate .claude/lib 2>&1 | head -30; echo ----; sed -n 1,80p .claude/skills/slop-gate/SKILL.md; echo; find . -path ./.git -prune -o \( -name '*.sh' -o -name '*.py' -o -name '*.mjs' -o -name '*.js' \) -print | grep -v node_modules | head -40
mkdir -p /tmp/cog-samples && printf 'Honestly, it is not about speed, it is about trust \xe2\x80\x94 that is the point.\n' > /tmp/cog-samples/draft.md && printf 'We shipped the export feature on Tuesday.\n' > /tmp/cog-samples/clean.md && cd <guest-path> && python3 .claude/skills/slop-gate/scripts/scan.py /tmp/cog-samples/draft.md; echo rc=$?; python3 .claude/skills/slop-gate/scripts/scan.py /tmp/cog-samples/clean.md; echo rc=$?
cd <guest-path> && grep -rIl -i 'cron\|--once\|--now\|webhook\|schedule' --exclude-dir=.git . | head -30; echo ----; grep -n -i 'cron\|--once\|webhook\|schedul' README.md SETUP.md WORKFLOW.md | head -20; echo ----; ls .github; find . -path ./.git -prune -o -iname '*test*' -print | head; echo; grep -n 'loop' .claude/skills/loop-engineering/SKILL.md | head -8
cd <guest-path> && grep -n -i 'cron\|schedul\|--once\|webhook' skills/content-factory/SKILL.md skills/memory-hygiene/SKILL.md skills/harvest/SKILL.md CLAUDE.md | head -20; ls skills/content-factory skills/memory-hygiene skills/harvest
cd <guest-path> && mkdir -p .coldpass && cat > .coldpass/probe.json <<'EOF'
{"kind":"cli","argv":["python3",".claude/skills/slop-gate/scripts/scan.py","/tmp/cog-samples/draft.md"],"cwd":"<guest-path>","expected_returncode":1,"expected_text":"[em dash]"}
EOF
cat > .coldpass/claims.json <<'EOF'
[{"kind":"claim","claim":"slop-gate refuses slop tells in outgoing text and runs in CI or as a hook","source":"Refuse slop tells in anything about to be written, published, or sent; runs in CI or as a hook","input":"/tmp/cog-samples/clean.md (a clean one-line draft)","expected":"scanner reports clear and exits 0","probe_kind":"cli","argv":["python3",".claude/skills/slop-gate/scripts/scan.py","/tmp/cog-samples/clean.md"],"expected_text":"clear","cwd":"<guest-path>"},
{"kind":"claim","claim":"validate-agent-surface catches drift between manifests, docs, and shipped files","source":"Before publishing or updating framework files, run `./scripts/validate-agent-surface.sh` to catch drift between manifests, docs, and shipped files.","input":"the shipped repo at the pinned commit","expected":"validator prints Validation passed with 0 warning(s)","probe_kind":"cli","argv":["./scripts/validate-agent-surface.sh"],"expected_text":"Validation passed with 0 warning(s)","cwd":"<guest-path>"}]
EOF
cat > .coldpass/examples.json <<'EOF'
[{"kind":"example","claim":"Install COG skills via skills.sh (README installer), run non-interactively into an empty directory outside the checkout","source":"README.md Quick Start: npx skills add huytieu/COG-second-brain","input":"huytieu/COG-second-brain --agent claude-code -y in /tmp/cog-npx-install with Node 22 on PATH","expected":"skills copied under ./.claude/skills","argv":["/usr/bin/npx","--yes","skills","add","huytieu/COG-second-brain","--agent","claude-code","-y"],"cwd":"/tmp/cog-npx-install","env":{"PATH":"/tmp/node22/node_modules/.bin:/usr/bin:/bin","NODE_USE_ENV_PROXY":"1"},"expected_text":"Done!"},
{"kind":"example","claim":"Check for upstream COG updates without changing files","source":"README.md Keeping COG Updated: ./cog-update.sh --check","input":"--check","expected":"reports local and upstream version and that everything is up to date","argv":["./cog-update.sh","--check"],"cwd":"<guest-path>","env":{},"expected_text":"Everything is up to date"}]
EOF
cat > .coldpass/cycles.json <<'EOF'
{"detected":false,"reason":"Entry points inspected: README.md, SETUP.md, WORKFLOW.md, cog-update.sh, scripts/validate-agent-surface.sh, and skill scripts. The repo ships no cron, scheduler, webhook, --once or --now entry point. Scheduling appears only in skill prose (content-factory says it may run nightly via cron/launchd, harvest says a user may schedule a job), and the user sets that up externally. slop-gate's hook wiring is opt-in and not shipped. So no product cycle is detected and no cycle was triggered.","checks":[]}
EOF
for f in probe claims examples cycles; do python3 -I -c "import json,sys; json.load(open(sys.argv[1])); print('ok', sys.argv[1])" .coldpass/$f.json; done
cd <guest-path> && ls -la <guest-path> 2>&1; ls -la /inputs/coldpass-preflight.py 2>&1; <env-var>=<guest-path> timeout 900 python3 -I <guest-path> --validate --replay; echo rc=$?
cd <guest-path> && cat > .coldpass/report.json <<'EOF'
{"outcome":"working","fault_owner":null,"operation":"Run COG's documented checks and its deterministic slop-gate scanner: validate the packaged agent surfaces, check for upstream updates, scan a draft for AI-slop tells (exit 1 with findings, exit 0 when clear), and install the skills via the README's npx skills.sh installer.","operation_scope":"Linux Ubuntu 24.04 guest, Python 3.12.3, pinned commit 144c7a3a959cc99538b7dfee9c22c4b065a0e156. Needs sudo for apt Node/npm and network access to GitHub and the npm registry. Not exercised: the conversational skills (onboarding, braindump, daily-brief, etc.). Those run inside an AI agent such as Claude Code, which was not available in this VM. Also not exercised: the optional Git sync, iCloud, and Obsidian setup in SETUP.md.","steps":["git init; git remote add origin https://github.com/huytieu/COG-second-brain; git fetch --depth 1 origin 144c7a3a959cc99538b7dfee9c22c4b065a0e156; git reset --mixed FETCH_HEAD","./scripts/validate-agent-surface.sh (exit 0, 0 warnings)","./cog-update.sh --check (exit 0, up to <email>)","npx skills add huytieu/COG-second-brain (README Quick Start)","python3 .claude/skills/slop-gate/scripts/scan.py /tmp/cog-samples/draft.md (exit 1, 4 tells)","python3 .claude/skills/slop-gate/scripts/scan.py /tmp/cog-samples/clean.md (exit 0, clear)","<env-var>=<guest-path> python3 -I <guest-path> --validate --replay (valid, no problems, replay PASS)"],"deviations":["Guest had no Node/npm; installed Ubuntu apt nodejs 18.19.1 and npm 9.2.0 with sudo apt-get install. Install succeeded.","npx skills add failed on Node 18 ([email protected] requires Node >=22.20; error: node:util does not export styleText). Installed Node 22.23.4 user-locally with npm install --prefix /tmp/node22 node@22 and put it first on PATH. Install succeeded.","npx skills add without flags is interactive and aborts when stdin is not a TTY (Nothing was installed). Re-ran with the installer's own non-interactive flags: --agent claude-code -y. Installed into /tmp/cog-npx-install, outside the checkout.","The installer skipped several SKILL.md files with YAML parse errors (for example slop-gate, review-cockpit, no-ai-slop, retro, ultragoal, feature-doc, editorial-illustrations, youtube-video-kit). It reported 41 skills found. The README advertises 43 skills.","cog-update.sh --check added a git remote named cog-upstream to the checkout. It made no other file changes.","The /inputs/coldpass-preflight.py path named in the task does not exist in the guest. Used <guest-path> instead, which the task's primary command names."],"stuck_step":null,"main_blocker":null,"plain_failure":null,"suggested_fix":"Fix the YAML frontmatter in the skipped SKILL.md files so the installer picks up every skill (the description values contain unquoted colons or nested mappings). Also document the Node 22.20+ requirement for the npx skills.sh installer and the non-interactive flags for scripted installs."}
EOF
python3 -I -c "import json; json.load(open('.coldpass/report.json')); print('report ok')"; <env-var>=<guest-path> timeout 900 python3 -I <guest-path> --validate --replay | python3 -c "import json,sys; d=json.load(sys.stdin); print('valid', d['valid'], 'problems', d['problems'], 'replay', d['replay']['status'])"; echo rc=$?; ls -la .coldpass; git status --short | head