agentic-vpslisted

Provision and harden a fresh Linux VPS into an autonomous-agent dev host using the capability-preserving model — the box IS the sandbox: full agent autonomy inside it (non-root sudo user, open egress, YOLO mode, any toolchain), contained by ISOLATION (non-root + VPN-only access + snapshot + no-long-lived-secrets), not by restricting the agent. Composes an idempotent provisioning script, a staged firewall/VPN lockout-safe sequence, and a deterministic verification gate. USE WHEN setting up a new VPS/cloud box for Claude Code / agentic development, hardening a machine to run coding agents unattended, "set up another machine like srv1692698", provisioning an agent dev host, or auditing whether a box meets the agentic-host security invariants. NOT FOR generic server hardening with no agent on it (that's standard CIS/Lynis), desktop/laptop setup, or Kubernetes/multi-tenant clusters. Triggers on "set up a vps for agents", "agent dev host", "harden a box for autonomous agents", "new agent machine", "provision agenti
broomva/skills · ★ 3 · AI & Automation · score 75

Install: claude install-skill broomva/skills

# agentic-vps — provision & harden a box for autonomous agentic development The verb for "make me another machine like the one we just set up." Distilled from the srv1692698 session (BRO-1550). It does **not** reimplement server hardening — it encodes the *capability-preserving model* and the *lockout-safe staging sequence* so a future agent reaches for it instead of re-deriving it. ## The one invariant > **The box IS the sandbox.** Security comes from *containing the blast radius* > (non-root agent user · VPN-only access · snapshot rollback · no long-lived > secrets in the agent's reach), **not** from *restricting the agent* (no tight > egress allowlist, no permission prompts, no seccomp leashes). The agent gets > the same freedom it has on a local machine — full sudo, open network, any dep, > YOLO mode — because a compromise is *contained and reversible*, not *prevented*. This is the user's standing constraint: **"secure but don't limit capability/autonomy."** The model and its threat-model rationale live in `research/entities/concept/lethal-trifecta-denial.md` and the playbook at `docs/security/2026-06-24-vps-agentic-hardening-playbook.html`. ## Hard rules (the lockout-safety sequence) These are non-negotiable ordering constraints. `scripts/staging_check.py` enforces them deterministically — a plan that violates them fails the gate. 1. **Snapshot before any risky change.** A rollback point must exist first. 2. **VPN up + verified BEFORE closing public SSH.** Bring u