hostwarden-securitylisted

# hostwarden-security Security configuration audit for a server or the local machine. **Never run automatically** — only on explicit user request. The whole of the Hostwarden first-connection onboarding pipeline still applies before any of this runs. ## Workflow 1. **Load overrides**, key `hostwarden-security`, per `rules/overrides.md`. Read `memory/machines/<hostname>/memory.md` for context: services, legitimate external bindings, VPN role. A binding this host is known to need is not a finding. An override of `rules/baseline.md` → Firewall or SSH Login changes what the firewall and SSH checks below expect. 2. **Run checks in 2–3 parallel batches** for speed — not one massive batch. If a single parallel tool call errors, Claude Code cancels sibling calls, so grouping limits blast radius. Put commands with complex quoting (awk, sed) in their own batch so a quoting mistake does not cancel simple commands. 3. **Probe shape:** no taboo word as data (the guard denies the whole batch), no `!` (zsh mangles it over SSH), and report what you do not recognize instead of printing only what you expect. The System Accounts check in `references/user-accounts.md` shows all three. 4. **Select checks** per the references below. Use the preferred method when privileges allow; fall back to the unprivileged method otherwise. 5. **Emit the report** using the format in `references/report-format.md`. 6. **Do NOT update memory**, with four except