Agentic Infrastructure — Multi-Machine AI Governance Audit¶

Governed Agentic Security Stack · Agentic Infrastructure Layer · February 2026

AI workflows are increasingly embedded across security operations, governance automation, and detection engineering. Yet the infrastructure running those workflows is rarely governed with the same rigor as production security systems. When AI agents operate across multiple machines without canonical standards, silent context drift becomes an architectural risk — undermining reproducibility, auditability, and defensibility.

This project operationalizes governance controls at the infrastructure layer to eliminate that risk.

The problem¶

Two production machines running daily AI workflows (Claude Code, Codex CLI, Gemini CLI) had silently diverged across six categories without any detection mechanism:

Root cause: No canonical standard. No audit process. No drift detection.

Governed Agentic Security Stack context¶

This project occupies two layers of the Governed Agentic Security Stack simultaneously:

AI is not a tool used within operations — it is an operational layer that must itself be governed, monitored, and defended.

Governed Agentic Security Stack
├── Agentic Infrastructure    ← THIS PROJECT (primary)
│   Hook architecture · Dotfiles standard · Install canonical · Vault path
├── Agentic GRC               ← GIAP™ (related)
│   Intake schemas · Policy enforcement · Accountability structures
├── Agentic Detection         ← TraceLock™ (related)
│   Real-time monitoring · RF signal anomaly · Behavioral signals
├── Agentic Governance        ← THIS PROJECT (secondary)
│   Permission controls · Override protocols · Context boundary enforcement
├── Adversarial Validation    (emerging)
└── Evidence & Assurance      ← THIS PROJECT (cross-layer)
    Fixed-schema audit reports · drift-check.sh · Validation log

Relationship to GIAP™ and TraceLock™¶

→ GIAP™ (Agentic GRC): GIAP governs compliance intake workflows. This project governs the agents running those intake workflows. Without infrastructure congruence, GIAP's audit trails are unreliable — a session on the desktop and a session on the laptop may produce structurally different outputs from the same prompt. This project makes GIAP's agent sessions reproducible.

→ TraceLock™ (Agentic Detection): Both projects use the same core methodology: fixed-schema outputs, automated validation scripts with binary pass/fail, and structured evidence logs. TraceLock detects external signals in the RF environment. This project detects internal infrastructure drift in the AI agent environment. Same discipline, different detection surface.

Architecture¶

Applied instance of the Governed Agentic Security Stack¶

flowchart TB
    subgraph MACHINES["Two-Machine AI Workflow (Production)"]
        direction LR
        DT["Desktop\nClaude · Codex · Gemini"]
        LT["Laptop\nClaude · Codex · Gemini · Fabric"]
    end

    SYNC[/"Nextcloud Sync\n.agentic/ and .codemap/ excluded"/]

    subgraph INF["① Agentic Infrastructure Layer"]
        I1["Hook-Driven Context Loading\n(UserPromptSubmit → codemap-userprompt.sh)"]
        I2["Canonical Install Standard\n(Homebrew — single upgrade path)"]
        I3["Versioned Dotfiles\n(path.zsh · tools.zsh — vault-sourced)"]
        I4["Machine-Independent Vault Path\n($VAULT_ROOT env var)"]
    end

    subgraph GOV["② Agentic Governance Layer"]
        G1["Permission Boundary Controls\n(wildcard permissions removed)"]
        G2["Override Protocols\n(AGENTIC_CODEMAP=0 · mode env vars)"]
        G3["Secret Guardrails\n(Keychain · pre-commit scan · HIST_IGNORE)"]
    end

    subgraph EVD["③ Evidence & Assurance Layer"]
        E1["Fixed-Schema Audit Reports\n(10-section schema, both machines)"]
        E2["drift-check.sh\n(8 congruence conditions, exit 0 / 1)"]
        E3["Post-Migration Validation\n(28 PASS · 1 WARN · 0 FAIL)"]
    end

    DT <--> SYNC
    LT <--> SYNC
    MACHINES --> INF
    INF --> GOV
    GOV --> EVD

Figure: The Governed Agentic Security Stack applied to multi-machine AI infrastructure. Three layers — Agentic Infrastructure, Agentic Governance, Evidence & Assurance — govern two production machines synchronized via Nextcloud. Machine-local AI context artifacts (.agentic/, .codemap/) are excluded from sync by design.

Methodology¶

Six phases, mirroring how platform security engineers handle production drift:

What I built¶

Canonical standard — 8 Architectural Decisions¶

Hook-driven context loading¶

User types .map prompt in Claude Code
    ↓
UserPromptSubmit hook fires (skippable: AGENTIC_CODEMAP=0)
    ↓
Three codemap commands: --diff · --depth · --deps
    ↓
Outputs → .agentic/context/{codemap.diff.txt, codemap.tree.txt, codemap.deps.txt}
    ↓
Agent receives fresh structural context automatically

Three operating modes via AGENTIC_CODEMAP_MODE:

Security hardening applied¶

• Pre-commit secret scanning — rg --pcre2 pattern hook on agent repos
• Global gitignore — .agentic/, .env, .venv/, .claude/.codemap_baseline excluded globally
• Shell history filtering — HISTORY_IGNORE pattern; space-prefix skips history logging
• API key storage — macOS Keychain only; no .env files in synced directories
• Wildcard permission removal — Claude settings.local.json pruned of sudo rm:* and dd:* wildcards
• Sync isolation — .agentic/ and .codemap/ excluded from Nextcloud; 25 → 0 directories syncing

Drift detection — 8 congruence conditions¶

Two machines are congruent when all eight pass:

1. Tool versions within one patch version between machines
2. $VAULT_ROOT resolves to a valid directory on both
3. Claude hook (~/.claude/hooks/codemap-userprompt.sh) present and executable on both
4. tools.zsh present and defines agent_ctx_here function on both
5. Global gitignore contains all standard exclusion patterns on both
6. No .agentic/ or .codemap/ files present in Nextcloud sync queue
7. Zero Nextcloud conflict files (*conflicted*) in vault
8. settings.local.json contains no deleted-volume path references

Automated: drift-check.sh (29 lines) verifies all eight conditions. Exit 0 = congruent. Exit 1 = drift detected. Designed to run weekly.

Results¶

The methodology scales horizontally to team-level AI environments and vertically to CI/CD-integrated agent workflows, where infrastructure congruence becomes a prerequisite for defensible automation.

What this demonstrates¶

Artifacts¶

Nine deliverables produced, all archived:

Related projects¶

• GIAP™ — GRC Intake Automation — Agentic GRC layer. This project ensures the agents running GIAP workflows produce reproducible, audit-ready outputs across machines.
• TraceLock™ — RF Threat Detection — Agentic Detection layer. Shares the same fixed-schema evidence methodology applied to a different detection surface.
• AgenticOS — AI Orchestration — Agentic Infrastructure layer. Provides the multi-provider execution layer that this audit governs at the infrastructure level.

Contact Me Innovation Overview