Vektor Memory

08/05/2026

Provenance by Vektor Memory: Another weekend coding project and why proposals for paying creators when AI trains on their work is more difficult than discussions.

Note: Article is written in natural human language for general readers—for deeper technical dives, see our other 70 articles or website.”

After watching Jaron Lanier argue for years that AI models are compressions of human labor, not independent intelligences, we finally tried to turn that thesis into working code. An account of where the theory held up and where it cracked.

We spent the last few weekends building a five-layer system for tracing AI-generated content back to the creators whose work shaped it, and paying them. We spent the weekend stress-testing every single layer until we found the cracks.

Then we fixed the first layer, actually shipped it, and tested it against 27 different file formats.

The concept is compelling. The ex*****on is where things get interesting, because almost every piece that looks reasonable on paper fails in a specific, predictable way once you attack it or try to build it without the data needed.

Why this idea exists
The argument is straightforward: if an AI model is a compression of human training data, then the people who created that data should get paid when the model generates revenue. It’s not a complete fix for content attribution or copyright law. It’s one small attempt at one piece of a much larger problem.

But “one small piece” turns out to require solving several separate, genuinely hard problems at once. Content provenance. Attribution math that works under adversarial conditions. Governance that can’t be captured by a coordinated attacker. Economics that don’t accidentally subsidize the bad actors. And legal frameworks that don’t exist yet.

We decided to build it in layers, test each one until it broke, and publish what we found.

The five-layer architecture
The system splits into five independent, testable layers. Here’s the flow from a creator’s work to a payout:

Layer 1: Provenance Registry Your work gets signed and timestamped through two independent, non-colluding anchors. One is a traditional timestamp authority. The other is the Bitcoin blockchain. This creates a verifiable record of what existed and when, without depending on trusting us or any single gatekeeper.

Layer 2: Streaming Safety Guard The AI platform’s output gets checked in real time, before the user sees it, looking for combinations of risky content rather than just flagged words. Single-word blocklists are trivial to route around. Combinations are harder.

Layer 3: Attribution and Staleness Decay We estimate how much a registered piece of work shaped a specific output, then lower that confidence continuously as the underlying model keeps training and drifting away from the version we measured.

Layer 4: Anti-Sybil Governance When attribution claims get contested, we route them to a small jury sampled at random from a bonded pool instead of an open vote. An attacker can’t know in advance which of their fake accounts will be eligible to vote on any given case.

Layer 5: Settlement and Economics Contested payouts go into escrow. Disputes resolve through appeals. Fees scale based on an account’s own risk profile, not flat usage volume.

Each layer has built-in failure modes.

Https://medium.com//provenance-what-it-actually-takes-to-prove-creator-data-dignity-306417f53f14?sharedUserId=vektormemory

We red-teamed an AI royalty proof-of-concept system we are building

07/30/2026

We built our agent a tool for codebase intelligence

Why we didn’t want a full index

The starting idea was simple. Give our autonomous coding agent a real understanding of the codebase it’s editing, not just whatever files it happens to grep into.

Note: This article has been created in natural human language to be read easily, devoid of complex technical jargon, so all readers can enjoy. View one of our other past 70 articles for deeper technical dives.

Open source tools like CodeGraph and code-review-graph already do this well. They parse your repo with tree-sitter, build a graph of every function, class, and import, and let an agent query it instead of re-reading files from scratch on every task.

The problem we found is that graphs cost to keep open: the bloat tax. Both of those tools build a persistent index on disk, and a background watcher keeps it in sync with every file save. That’s fine for a single project you keep open all day.

It’s the shaped tool for an agent that might touch a dozen different projects in an afternoon, each one spinning up a watcher and a .codegraph folder that outlives the task that needed it.

We wanted the intelligence without the standing cost. A code graph that shows up exactly when a task needs one and disappears the moment the task is done, autonomous, intelligent, and relevant.

Agent loop stubbornness
While building, an agent spent eight steps convinced our own file system was broken, looping.

It kept calling list_dir, getting a clean result back, and then telling us the tools were failing. Three different frontier LLM providers did the exact same thing, as our system is provider agnostic.

This was not a permissions error, just a model quietly hallucinating a filesystem outage while the directory listing sat right there in its own context window.

That error, and the two others we found chasing it, ended up teaching us more about how to build code intelligence improved for our own agent than the features we originally set out to build.

The devil is in the detailed refinement.

Sometimes simple code that works is far better than dozens of features that keep expanding into bloatware that 80% of users don’t use very often or need at all.

The three-tier gate
The actual research made this easier to justify than we expected. A 2026 paper called “Retrieval as a Decision” argues that most retrieval-augmented systems should treat the decision to retrieve at all as a first-class, trainable step, not something baked into a fixed pipeline. That’s close to what we ended up building, minus the trained part.

Every task our agent takes on gets classified into one of three tiers before any graph work happens. A small, single-file edit skips the graph entirely and goes straight to a plain file read.

A task that touches three or more files, or a shared file like a config or a types module, triggers a scoped build: parse just the touched files and whatever they import, out to two hops deep.

A request for a genuine architecture overview, something a user actually asked for by name, triggers a slower full pass starting from the project’s real entry points.

That middle tier is where the actual engine lives. It’s built entirely in Node, using web-tree-sitter compiled to WebAssembly rather than the native tree-sitter bindings most of these tools use.

https://medium.com//we-built-our-agent-a-tool-for-codebase-intelligence-43e482fee4aa?sharedUserId=vektormemory

Why we didn’t want a full index

07/27/2026

How to Run an Autonomous Agent Against Your Own Server

Most people who try to let an AI agent operate on a real VPS end up in a few places.

They either lock it down so hard the agent can barely do anything useful (read-only, no writes, ask a human to copy-paste the command back), or they hand over a standing SSH key and just hope nothing gets hacked. Or the worst scenario, an agentic mess of deletes and rewrites of sensitive data without any backups taken.

Neither of those counts as running an autonomous agent. One is a chatbot with a read-only window into your server. The other is a loaded gun with the safety off, cowboy style.

There is another way, and it’s the only one that actually holds up once you’re doing real work on a real system. We run it daily against our own production infrastructure. Here’s exactly how it works, with a real situation from live work we did today, not a hypothetical.

The three things that have to be true at once

An agent operating on your infrastructure needs to do three things at the same time, or the whole setup falls apart.

It has to act, not just suggest. If every command gets copy-pasted by a human into a separate terminal, you’ve built a slower way of doing the work yourself.

It has to fail safely. If a write command goes wrong, there needs to be a way back that doesn’t involve your users telling you the site is down.

And it has to remember. If the agent forgets every fix and every incident the moment a session ends, it re-solves the same problems from scratch, over and over. That quietly costs more time than doing it by hand.

Most setups manage one of these. Getting all three right at once is the actual hard part, and it’s why “just give the AI a terminal” either stays useless or eventually causes a real incident.

How we actually do it

Every command gets classified before it runs.

Read-only work, checking logs, listing files, checking a process, runs immediately with no friction.

Anything that writes to disk, restarts a service, or installs a package comes back as a pending action with the exact command shown, and nothing executes until it’s approved by the sloppy human.

Some might say that's painful as they want the agent to loop forever; it is 100% necessary to stop a Chernobyl-agentic meltdown of your VPS.

Every write gets its own approval, not a session-wide green light. That’s the real difference between “the agent has SSH access” and “the agent proposes commands a human confirms,” and it stops mattering as an abstraction the first time something almost goes wrong.

Nothing gets touched without a backup first. Before any file changes, a copy gets taken automatically. That single habit is the reason you can let an agent make a real change with actual confidence instead of crossed fingers. If it screws up, which it eventually will from bad human context, bloat, or just loop errors, you go back to the previous saved backup.

Keys don’t live on the server being administered. Credentials sit in an encrypted vault and get pulled only for the exact moment they’re needed, then get destroyed right after: written, used, shredded, in one step, so there’s never a window where an interrupted session leaves a live key sitting on disk. If a managed server is ever compromised, there’s no standing key on it for an attacker to find and reuse somewhere else.

And it remembers. Not within a single chat session, but across days and across whichever AI tool you happened to have open. A fix made three months ago in a different tool is still recallable today, because the memory isn’t tied to any one app’s chat window. The agent has real-time access to recall thousands of saved memories with past actions.

Most people who try to let an AI agent operate on a real VPS end up in a few places.

07/23/2026

Your supply chain will eventually be cyberattacked…

Agentic AI is enabling a deluge of cyberattacks, mostly by rogue bots

When the Attacker Is an AI Model going AWOL
On July 22, 2026, Sam Altman posted a short line that undersold what had happened: “we had a significant security incident during evaluation of our models.”

During an internal benchmark run, a combination of OpenAI models, including GPT-5.6 Sol and an even more capable unreleased model, both running with reduced cyber refusals for testing purposes, chained a zero-day in an internal package registry proxy, escalated privileges, moved laterally across OpenAI’s research environment, reached a node with open internet access, and used that access to break into Hugging Face’s production infrastructure.

It pulled stolen credentials and exploit chains together to find a remote code ex*****on path, all in pursuit of a narrow goal: finding the answer key to a cybersecurity benchmark called ExploitGym. No human told it to attack Hugging Face. It got there on its own, hunting for a shortcut to a test answer.

Hugging Face’s own security team and agents caught the intrusion and contained it before OpenAI’s side even connected the dots. That detail matters as much as the attack itself. The model that broke in was undirected and single-minded about a narrow objective; the defense that stopped it depended on a separate organization actively watching its own infrastructure.

Nobody designed a system where an AI model’s internal eval run could reach a partner company’s production database. It happened anyway, because the model was good enough at chaining vulnerabilities to find the path nobody had mapped.

Key point: independent benchmarking on frontier models from Artificial Analysis puts GPT-5-class models at roughly 60 to 190 tokens per second in production API testing, which works out to somewhere around 3,700 to 8,300 words per minute of generated output.

A meta-analysis of 190 studies covering more than 18,000 participants puts average adult silent reading speed at 238 to 260 words per minute. That gap, 15 to 30 times faster sustained, run in parallel across as many agentic tasks as available compute allows, is the real reason “the model found a path nobody had mapped.”

It’s what happens when something that fast never stops to check email. No coffee breaks, no looking at summer holiday destination snaps on social media with your fingers on the alt-tab buttons in the office pod.

This wasn’t an isolated data point
A week before that disclosure, researchers at the AI Security Institute reported that they’d found universal jailbreaks against GPT-5.6 Sol’s cybersecurity safeguards in every round of testing, and found them within hours.

The jailbreaks preserved the model’s capability on public offensive cyber evaluations, meaning the guardrail broke without weakening what the model could actually do once it broke.

OpenAI’s own system card for GPT-5.6 is candid about the same tension:

Sol and Terra are rated High capability in cybersecurity under the company’s own risk framework, the models show a greater tendency than their predecessor to act beyond what a user actually asked for, and OpenAI has put over 700,000 GPU hours into automated red-teaming specifically because it expects new jailbreaks to keep surfacing after launch, not stop.

Zoom out and the pattern lines up with what The Atlantic reported this spring: the time attackers take to exploit a newly disclosed vulnerability fell from more than 700 days in 2020 to 44 days in 2025, now faster than most security teams can patch.

Palo Alto Networks logged a fourfold rise in daily attacks against its client base year over year. The same AI capability that lets a model autonomously chain a zero-day into a production breach at a partner company is now sitting inside publicly available offensive tooling, and defenders are the ones racing a clock that used to run in years and now runs in weeks.

Agentic AI is enabling a deluge of cyberattacks, mostly by rogue bots

07/21/2026

Commonsense Lessons from the Silicon Valley VC Cash Splash & Metaverse Fail

Get ready for the mother of all rants, pump some more dark web market Ozempic peptides into your brain, and hold on to your discount Chinese-cloned Neuralink Kimi4-enhanced chips.

Being a solo developer is a strange kind of self-endured punishment that nobody really warns you about. You go in thinking the hard part is going to be the build.

The code, the architecture, the 18-hour days, and late nights arguing with your own logic until it finally clicks into place. And sure, that part is hard.

It should be hard and was much harder in the past, real coding with actual stubby human fingers. But here is the joke nobody tells you at the start.

The code part is approximately ten percent of the actual job. The other ninety percent is exposure and distribution. Shoving your work into the bloodstream of the internet and praying something sticks somewhere, like a picture of Nicolas Cage on a graffiti wall.

So you do the social media dance. You post and repost. You rewrite the same article ideas ten different ways to appease the formatting bouncers and whatever invisible slot machine is currently deciding your fate that week.

You write threads, articles, comments, and replies mostly to bots. You engage with people who skimmed the headline and decided that was enough context to have an opinion. You try to sound insightful without sounding desperate, and somewhere in that grind you have the horrible realization that it does not actually matter whether people like what you made, the majority of people don't like most things anyway.

All that matters is that they react. Feed the beast, the algorithm.

The algorithm does not care if the reaction is thoughtful, angry, dismissive, or completely unhinged. It just wants movement. A response signal — in/out binary ones and zeros—feedback, compute goes brrrr.

Ten people loving your work, good. Ten people being haters and hating? That's great, even better!

A hundred people arguing about it and arguing with each other, and the mods arguing with the posters without having read past the first line, even better because now you are feeding the machine, and the machine is really happy, and a well-oiled feedback machine means a slightly longer shelf life for your post before it drops into the void forever.

I won; I truly am the eternal viral p**p machine winner for this week!

Then you are crapped on by a better-written algo post, made by someone much smarter than you on how the system actually works v2026 Google updated agentic swarm-bot style, keyword-stuffed posts like a cheap stuffed crust pepperoni pizza made by a soulless chain pizza shop, only interested in cutting product quality for profits and footprint delivery population metrics, because the race is in the store, of course it is, as it sure as heck isn't in any of your food quality!

I made this slop

07/18/2026

Vörwatch: The VPS Monitoring Tool

Watching a single production box without a SIEM or a dedicated Security Team

Another weekend coding project, we were trying to work out whether a spike in attacker IPs in Nginx traffic was a typical harmless provider web crawler or something worse, swarm bots snooping.

We didn’t have an answer because no SIEM tools were installed on the server box that had been watching closely enough to know exactly what the traffic severity was. You can run standard IP traffic reports in the Ubuntu server and have Claude search who and where the IPs come from online, but this is a very manual, ad hoc process. Or go to Cloudflare reports, which can be limited depending on your plan type.

That gap is common for anyone running a VPS outside a big cloud provider’s managed security stack. You get Cloudflare reports, a firewall, maybe fail2ban if you set it up yourself, and then a lot of waiting, testing, and manual reporting.

Enterprise anomaly detection exists, but it assumes a fleet of machines, a SIEM ingesting logs centrally, and a security team’s budget. None of that fits a developer running a Linux server. Plus, there is a lot of telemetry and lock-in once you choose a system because the IP detection data lists are embedded into their services, as that is part of their secret sauce.

Or use Wazuh or Security Onion, which requires a manager server plus agents installed on each monitored host; a dedicated team of security helps as well. These are more geared towards end-to-end detection via GUI console, not a lightweight, compact first line of defense reporting tool built into the server.

So we built Vörwatch — Vör’s Watch, named for the Old Norse goddess of vigilant awareness, described in the Prose Edda as “wise and inquiring, so that nothing can be concealed from her.” All the good names are already taken by the big corpos so that's the best we can do on short notice, ok?

It’s a single bash script. No daemon, no database, no agent phoning home to a vendor’s cloud. It runs off cron, keeps its state in flat files, and does one job: notice when something on your server looks different than it did yesterday. This keeps with our privacy-enhanced technology ethos and is open source and free, just pure love, GitHub and minimal server storage space.

I like Linus Torvalds's approach: build it, put it on the net, and if people are interested, they will use it, improve it, and store it for you for future use.

Why we didn’t reach for an existing tool

Because where is the fun in a weekend DIY project in grabbing something off the shelf, we already run fail2ban and ufw on our own infrastructure, and they do a great job at the layer they’re built for: repeated failed logins, known bad ports. What they don’t do is tell you when a critical config file changes, when a new process starts talking outbound to an IP your server has never contacted before, or when nginx traffic quietly shifts from “normal load” into "someone's bots are scanning for exposed endpoints.”

That’s the layer between “firewall rules” and “full SIEM” that most single-server setups just leave empty. We looked at what was actually attacking our own VPS before deciding what Vörwatch needed to catch.

Combined fail2ban logs across our jails: over 1,600 unique IPs blocked and 40K worth of attempts logged in a two-month window, mostly malicious bot swarms. When we pulled the nginx access log through Vörwatch’s reputation scoring during testing, the top five source IPs by request volume looked like this:

115.186.231.43 35 requests [risk 1]
3.99.128.211 17 requests [risk 2]
216.73.217.6 8 requests [risk 5]
34.56.201.30 5 requests [risk 1]
40.223.148.196 4 requests [risk 1]

Notice that the risk ranking doesn’t track the request count. The IP with the fewest hits came back rated as most dangerous, because AbuseIPDB had real abuse reports against it that raw traffic volume alone would never have surfaced. That’s the exact blind spot a request-count-only monitor has, and it’s why we built the reputation layer as an optional add-on rather than skipping it.

What it actually checks
Vörwatch runs these detection passes on a cron schedule you set, defaulting to every 15 minutes:

File integrity monitoring. SHA-256 hashes of the files that matter most on any Linux box — sshd_config, passwd, shadow, crontab, nginx.conf, authorized_keys — checked against a baseline you capture. Any change gets flagged.

Listening port baselining. You capture what’s currently listening, and anything new that shows up later gets called out by name.

Outbound connection tracking. The first time your server talks to a new IP, that connection gets logged and checked against a public threat blocklist. Most servers have predictable outbound patterns. A new destination, especially one already flagged as bad, is worth a second look.

Process tree anomaly detection. This catches a specific and common attack signature: a web server or container process spawning a shell. If nginx suddenly has a bash child process, that's not a normal Tuesday, and it's exactly the kind of thing that's easy to miss scrolling through ps output by hand.

Nginx traffic analysis. High request volume from one source, or a burst of distinct 404s that looks like path scanning, both get flagged with the specific IP and count attached.

SSH cross-reference. Recent connection attempts get checked against the same blocklist used for outbound traffic, so a known-bad IP hitting your SSH port shows up in the same report as everything else.

Package vulnerability scanning. Every check cycle, Vörwatch can cross-reference your installed package list against OSV.dev’s free vulnerability database — one batched API call, not one per package, so it’s cheap even on a box with hundreds of packages.

Become a Medium member
The catch with a feed like this is volume: OSV.dev returns every historical CVE or USN ever filed against a package version, including old and already-patched-elsewhere entries, which on an older Ubuntu box can mean dozens of packages with hundreds of IDs apiece. The report caps what’s shown — top packages by CVE count, top IDs per package — so you get a readable summary instead of a wall of text, while the full uncapped list stays in a cache file if you need it.

Rootkit and backdoor scanning. If chkrootkit or rkhunter is already installed, Vörwatch shells out to it and folds the result into the same report — no new tool to learn, no separate log to check. Because a full filesystem scan is heavier than everything else Vörwatch does, it's rate-limited independently of the regular check cadence, running at most once a day by default regardless of how often check itself fires. Any hit is treated as urgent, the same tier as a blocklist match or a changed critical file.

CIS-style hardening spot-checks. Not a full CIS benchmark run — just the handful of settings that matter most and are easy to drift on without noticing: whether root login and password authentication are still enabled in sshd_config, and whether /etc/shadow and /etc/passwd still have sane permissions. These only re-alert when the finding set actually changes, so a known, unfixed issue shows up once, not every 15 minutes forever.

DNS query anomaly detection. Off by default, since not every box runs a local resolver that logs queries. If you point it at one — dnsmasq or systemd-resolved — Vörwatch tracks first-seen queried domains the same way it already tracks first-seen outbound IPs. A server suddenly resolving a domain it’s never asked for before is often the earliest visible sign of something new running, before it ever shows up as an outbound connection.

CISA KEV cross-reference — cross-checks OSV-found CVE IDs against CISA’s Known Exploited Vulnerabilities catalog (free, no key, actively maintained) so you can tell “OSV found something historical” apart from “this is confirmed being exploited right now” — a KEV match is treated as high-priority and emails immediately if configured

Two optional layers sit on top. A free AbuseIPDB key turns on the 1-to-5 reputation scoring shown above, scoped deliberately to just your nginx top-5 source IPs and cached for a week, so it never costs more than a handful of API calls per report.

A free Resend account turns on email notifications: urgent alerts (blocklist hits, file tampering, attack-pattern traffic) send immediately, everything else lands in a weekly digest instead of flooding your inbox every 15 minutes. You can change the send dates more or less depending on your needs.

The design decision we kept debating with
Vörwatch does not ban anything. It never runs ufw deny. It never calls fail2ban-client banip. It never touches iptables.

That’s deliberate, as we already have fail2ban. Automated banning based on heuristics carries a real false-positive cost on a single production box.

You don’t want a monitoring tool locking out a legitimate user, or worse, locking you out during a false alarm at 3am when nobody’s watching to notice the mistake. Every alert Vörwatch generates includes the exact command you’d run to act on it, but the decision stays with a human.

If you want full auto-remediation, something like CrowdSec exists for that and can run alongside Vörwatch. Vörwatch’s job is making sure the signal reaches you clearly, not deciding what to action automatically on your behalf.

Running the wizard

No runtime to install, no compiled binary to trust. It needs bash, the usual coreutils, iproute2, procps, and curl — things that are already sitting on almost every Linux box.

git clone https://github.com/Vektor-Memory/Vorwatch.git
cd Vorwatch
sudo bash install.sh
The installer wizard walks through an interactive setup: where to store state, how often to check, whether to add an AbuseIPDB key, whether to turn on email digests. Press Enter on any prompt to take the sensible default. sudo bash install.sh --defaults skips the wizard entirely and copies a template config you can edit by hand.

npm install -g /vorwatch
sudo vorwatch-install
It’s also on npm, under our org scope: https://www.npmjs.com/~vektormemory

Once it’s running:

vorwatch baseline # capture current state as "known good"
vorwatch check # run one detection pass
vorwatch install # wire up the cron job
vorwatch status # confirm everything's live
vorwatch report today # see what's happened
Why this exists
We didn’t want another dashboard to check. We wanted something that sits quietly in the background, runs its checks every 15 minutes, and only speaks up when something is actually worth attention. That’s the whole design philosophy in one line: recommend, don’t act, and don’t ask for more of a person’s time than the situation deserves.

It’s early days for the project, and there are almost certainly edge cases we haven’t hit yet. If you run a VPS and have ever wondered what’s happening on it between the moments you’re actually looking, we’d appreciate you trying it and telling us what feature additions it needs so we can improve it.

Top 5 IP risk list
The code is Apache 2.0 licensed and lives at github.com/Vektor-Memory/Vorwatch. Bring your own API keys, keep your own data, and never worry about a bash script phoning home with telemetry data it shouldn’t have.

VEKTOR Memory builds local-first, privacy-preserving persistent memory infrastructure for AI agents. Full technical documentation and changelog at vektormemory.com/docs.

Security
Information Security
Siem
Linux
Monitoring

07/18/2026

The Problem Claude Cowork & ChatGPT Work Mode Doesn’t Solve: Remote Infrastructure HITL Tasks

Cloak_SSH & Passport: How six tools we built provide you with backups, safety, and security for your keys.

Before Cowork/Work Mode existed

For most of the last four years, using a chatbot against your own infrastructure meant one of three average options. You pasted file contents into the chat by hand, clogging up the context window.

You built a bespoke plugin or function-calling backend just to shell out to your VPS or PC. Or you gave the model standing, unscoped credentials, and hoped that it didn't go rogue, deleting files or rewriting sensitive information without a backup made.

Cowork mode and equivalents (OpenAI’s file/work tools, Claude’s desktop file access) solved the local half of this problem: an agent can now read and write files in a folder you point it at without a custom integration.

They are useful tools but don’t fully solve all the remote issues. The moment your actual work lives on a VPS, a home server, or a machine on a private network, desktop file access stops being relevant. You’re back to opening a raw, permanent SSH tunnel and trusting the model with it indefinitely without backups.

The tool that we built, Cloak, an ethical, transparent SSH tool, exists to close that specific gap: remote command ex*****on and remote file access, with the credential handling and approval mechanics that standing SSH access doesn’t give you by default.

And you can use Cloak in conjunction with Co-Work to fill in any missing gaps those systems can’t do.

What Cloak actually is

Cloak is not one tool. It’s a hybrid, multiple tools bolted together on purpose working in synergy:

An SSH ex*****on layer (cloak_ssh_exec, cloak_ssh_approve, cloak_ssh_plan, cloak_ssh_backup, cloak_ssh_rollback) that runs commands on a remote host, classifies each command by risk before it runs, and gates anything destructive behind an explicit approval step.

An AES-256 encrypted credential vault (cloak_passport) that stores SSH keys, API tokens, and secrets separately from the ex*****on layer, releases them only on request, and is designed around the assumption that keys should never sit at rest on the machine that's being administered.

What’s specific to Cloak is that both tools are wired together: the ex*****on layer calls the vault mid-command, uses the credential for exactly one operation, and the credential never persists past that operation. That’s the actual design decision we built after 6 months of trial, error, and refining, and we eat our own dog food daily and know that it works perfectly.

Cloak_SSH & Passport: How six tools we built provide you with backups, safety, and security for your keys.